Tip of the iceberg. It is generally safe to assume that local government systems are vulnerable given the types of vendors they have and the horrendous wages they pay IT administrators. Hilarious things happen all the time that nobody knows about, like that one guy who got access to all the wallets for the Seattle public transit system by incrementing a counter.