[nbh1]

I read something around 16 servers had root access obtained and then everything removed. It seems more likely somone had root access or an ssh key on the servers.