We hired a web application developer firm to design and host a community website for us. They recommended Joomla contact management system for ease of use and security and they designed the website for us and implemented all the necessary modules we needed for our community site. Recently our website was hijacked by a hacker and when we brought this to our hosting company. They told us the issue is known and upgrading our Joomla CMS to the latest release would address the issue. We are told it would take 8 hours to upgrade our Joomla to the latest version. Should we be charged for this service or should they be responsible for it given the fact that they recommended Joomla and that they are hosting it at the same time? One part of me is saying they should provide a more secure environment but at the same time I am not sure if they should be held responsible and share the cost of upgrading it. What are your thoughts?