First of all, the entire site is CMS-driven - all pages. The first time it happened, they changed page content on the home page with nothing but garbage text and some type of "you've been hacked" statement. All of the content on the other pages had been deleted. I thought they got in through the admin area, so I changed all of the admin passwords by using a password generator, but it doesn't appear that was the problem. The tech support person at my ISP mentioned that he has been seeing quite a few issues with the FCK Editor and hacks recently, and he's thinking it's coming from the editor and they don't even need access to the admin area. This time, the only page that was changed was the home page and they did not change anything else.