Now we can all finally breath...
Service was restored as of 1 AM PST last night.
Without going into too much detail, there were/are no security holes in Apache or any of our applications (everything is up to do). The "hacker" was able to obtain my root password (which is complex), most likely from one of the vendors I work with. My root password has been changed (to something even more complex) along with additional security measures now in place.
The "hacker" logged in as root, and ran a wget command to download a .pl script from a remote server. He then ran the script, which all it did was replace anything that said index.* with his pre-made index page. He also ran an rm -rf on all apache log directories in attempt to cover his tracks, though little does he know that his SSH session was saved.
Unfortunately since this POS is located in the middle east there is no point in trying to proceed with any legal action.
A complete server restore from May 9 was performed yesterday, beginning at approx 12 PM PST and finally ending at approx 1 AM PST this morning.
Thank you all for your patience. I have put measures in place to mitigate any risk of this happening again.
Rod