Some hacker managed to replace an image file on the site with an "inappropriate" image file. I don't see any evidence of any other files getting overwritten and I don't see any evidence of the original file being accessed in any of the log files I have examined. I don't see any evidence that anybody used the credentials of any of the few users that the site has.Â
I have Admin Tools configured to either prevent or report any activity that might be suspicious or harmful and I don't see any report of any of that.
Do you have any ideas about how I might further investigate how this hack was accomplished? Until I find out how it was done and plug that hole, the site is vulnerable to further serious attacks.
I can provide you with credentials to allow you to access the site as a Super User if you would prefer to investigate yourself. Thanks.