Worst one I had was about 12 years ago when I got a phone call from the local golf club I'd set-up a site/CMS for, not kept patched as well as I should've, and a club member reported they were served porn ads instead of the Saturday draw... That was a lesson learnt