Apparently state.gov runs on WordPress (if you View Source, there are a number of comments which reference WP plugins). My guess is something was badly configured and someone broke in and vandalized the page.