I frankly have no idea what permissions.yml is used for.  I recommend to install LuckPerms and use this to handle your permissions.  It's an extremely powerful tool, and something you should learn your way around anyway.

There's a lot of reasons your server can be backdoored and it's likely not Minehut's fault.  It could be that you accidentally added an exploit you didn't know about, or a staff member's account got hacked.  This stuff happens.  Here's what you can do to prevent it in the future.

1. Require all staff members to have two-factor authentication on their Minehut, Discord, and Microsoft accounts, as well as any other accounts that can be relevant to your server.  This makes it practically impossible for bad actors to brute-force their way into your accounts.
2. Create frequent backups on your server.  I don't know if Minehut has a built-in backups system, but if it does, you can make use of that.  In addition, occasionally download your whole server to your computer.  This functions as an offsite backup which you can reupload in the case of something like this happening again.
3. Check your logs whenever something like this happens.  In my server, we had an exploit which allowed users to delete one another's claims.  We were able to catch who did it by opening up old server logs (which you can find in your /%root%/logs/ folder) and searching for suspicious commands being run.  You can use this to find the culprit and ban them, and also figure out how they did it so that you can prevent it from happening in the future.

If your server has backups, reload the most recent one.  If not, then you're going to have to do some rebuilding.  It sucks, but maybe it's just a chance to build back better.

Show us your plugin list, and make sure that the user in question is not banned by username or banned from Minehut.

Luckperms is not just easy to use but absolutely essential to running a public server.  It's a good idea to learn it.

@Outspending Is there a promocode so i can buy credits?