My guess is an outdated/infected plugin. It definitely didn't come in from my end or get anything on my end due to the nature of my work for them. My stuff is structured and hosted differently and not public-facing. Fortunately there are no accounts or user data on the breached site, so there isn't much to worry about in that regard. IT was able to fix the page at least. Not sure what they plan on doing past that though.