The deface page used by Hitman is identical to those being used on the educational institution.
“Secure your site Admin..,” it reads.
A quick analysis on those incidents, the hacker might have been compromised the whole server in which the websites are hosted.
The image above shows the websites are on the same server(207.198.100.183), that means the other 170 domains sharing on the server are vulnerable as well.