Thx. Timeline shows attack begun by adding ignore entry in .gitignore file. That is hard to detect nowadays.