All the UK regional police force websites outsource their hosting to third party companies, usually with a CMS provided so the web administrator can update it from the force HQ. I did some work on one, they had a single Webmaster with another lady who chipped in an afternoon here and there, plus other access was granted to the press office for the news section, HR for job postings, and other little things like someone on the helicopter crew allowed to update this small page which was sort of a blog for air support call outs. The only forces which don't necessarily outsource it are the Met, ones in Scotland and the Garda (but they probably all do).Understanding this all I can suggest is that Durham got targeted because some opportunist found a vulnerability in the system of the hosting company and then looked at a list of all the sites they host and found the most exciting one to damage. The revenge motive is probably a load of bollocks, most of the sites have little more than niceties, contact details, timetables, and forms. The actual police intranet is on a completely different system and completely disconnected from the grid