Posted here because as banal as many of the actual details turn out to be, I found it rare and refreshing for non-tech journalism to uncover what exactly happened, who messed up what and when. I'm not even sure pwning a city email address by phishing should be called a "cyber attack", but there ya go.
