Did they obtain any user/account details?
i.e. email addresses and/or passwords?
How has nobody asked this lol.
If they got in to the point of being able to replace the homepage, then yes, it would have been trivial for them to obtain e-mail addresses and
hashed (often inaccurately termed "encrypted") passwords. This is because the database password is stored within a PHP file in SMF, so having file access would effectively grant them database access.
Whether they actually took any of that information is another question, and one we're unlikely to ever know the answer to for certain. However, it strikes me as unlikely -- it seemed like a fairly basic script kiddie attack. Someone who actually wants your data is likely to try to obfuscate their presence, not replace the homepage with "YOU GOT HACKED LOL".
Nevertheless, it would be prudent to follow general best practices with regard to passwords. Specifically, use strong passwords that are difficult to brute-force given a hash, and never use the same password for two different websites. If you are already using the same password elsewhere as on here, I would recommend changing it everywhere -- and to something different in each place -- to be on the safe side.