I know of multiple municipalities (Illinois in this case) where there's a single point of failure for these kind of attacks. I am sure there are quite a few of these cases that never get reported to the public, especially after my experience with the quality of many of the audits that smaller and mid-size communities go through.