I'm A Person lists some good steps. I would add that using the AllowUsers directive in sshd_config allows you to specify that only certain users can log in - e.g. "AllowUsers imaperson" means that imaperson can log in but any attempt to log into root, apache, postgres, or whatever other accounts exist on the system would fail, even with a correct password. This takes things a step further than 'PermitRootLogin no'.
To answer your larger question, you're not being hacked per se; you're being automatically scanned. It goes on almost continuously and blindly on the Internet, which is why I'm A Person's advice about the default port is useful. My personal server had about 200 attempts in the last 12 hours, which is normal or even low. It's generally noise and not a targeted attack on you.
Failed attempts in the last 12 hours: