2013 — Drupal: Malicious files placed on association, 1.0M records
Technical writeup
Malicious files placed on association.drupal.org servers via a 3rd-party application. Exposed usernames, e-mail addresses, country information, and cryptographically hashed passwords.
Root cause
Hacked