tl;dr version: Site should be coming back as clean for everyone.
What happened?
It appears that an infected server (not ours, a random one on the web) was used to grab our index files through ftp, append some malicious code, and return the files to their position on the server.
How did they get in to FTP? Don't you have passwords or something?
We had an account activated for a freelance web developer in order to help with the transition to the new server. We don't believe the freelancer had anything to do with the hack but the password on the account was simple enough to be brute-forced.
Are you sure it is all gone?
Our file transfer logs showed all files that were accessed and we have gone through all files affected. The code has been cleaned from all of these files. I don't like dealing in absolutes but yea, I'm sure it is all gone.
Why did you originally say it was the ads?
I was unable to recreate the issue and, in the past, I've dealt with similar issues where I was unable to get the right ad to load so some people would see the error while others wouldn't. In this case, the malicious code was designed to not activate for specific browsers. Google Chrome was among the browsers that were ignored so, when I visited the site, I was unable to see the line of code.
What have you done to ensure that this doesn't happen again?
Though this looks like it was just the work of a script and not of an actual user, we have changed all passwords related to the server. We have also disabled the account used to make the changed to the files. Finally, we have activated filtering for FTP so that FTP commands can only be accessed using specified ip addresses.
Was my password at risk?
The logs do not indicate any attempt to access or view any user data. Even if the hack attempt had led to access of the users database, all passwords are hashed and salted. This means that we can't even see what your password is if we want to do so.
Why all this information?
We want to make sure that we have clear communication about these sorts of events with our users.
