1) Be sure to delete Orders from your website as soon as they are processed. Even if a hacker compromises the server, they won't get old orders.
2) You need to help ensure that your server is secure. This requires both a strong Administrator password along with secure (SSL) hosting, and no unsecure FTP accounts. Check with your web host if you are concerned about any of these issues.