Illustrative composite. Real incident shape, anonymized municipality.
Sunday, 10:47pm, of a long weekend. A resident texts the city's communications director: the library's homepage now displays a political slogan in Cyrillic and a meme. The resident has screenshotted it and is asking if it's real.
10:52pm. The communications director can confirm it's real on her phone. She calls the on-call IT lead. The IT lead opens the CMS admin portal — and the library editor account is logged in from an IP in Eastern Europe, last activity two minutes ago.
10:58pm. IT revokes all sessions for the library account, forces a password reset, and disables the account entirely. The CMS vendor's after-hours line is called; a P1 case is opened and flagged as Security.
11:06pm. The defacement is reverted from the CMS revision history. The page is restored to its prior version. Total visible-to-public window: 19 minutes from first report.
11:18pm. The communications director posts a short note on the city's official social channels (not the CMS): "The library website was briefly altered tonight. The page has been restored. No resident data was accessed. We will share more after our review." Three sentences, no speculation, no threat-actor naming.
Tuesday. CMS vendor confirms the entry vector: credential reuse. The library editor's password matched a credential from a 2022 third-party breach in HaveIBeenPwned. No other accounts in the tenant were compromised. The city enforces MFA on every CMS admin and editor account within 24 hours.
What went right. A resident knew which staffer to text. The on-call IT lead actually answered. Session revocation before password reset (the right order). A short, factual public statement from an off-CMS channel. CMS revision history made restoration trivial.
What didn't. MFA had not been enforced on CMS editor accounts — only on admins. The library account's password had not been rotated in three years. There was no automated alert on logins from new countries; the only reason anyone found out was a resident's text message.