A site I administer was "Hacked By KhronicK" on Wednesday and he deleted everything in the database. Luckily it was backed up and only a couple of posts were lost.
When I restored it all I upgraded to 1.2.6 and the security updates obviously work as he registered as a user (Khro) again today but couldn't get any further 
He needs a good thrashing 
Malky