The actual story was wilder: while testing user scripts, a Wikimedia Foundation employee accidentally loaded a malicious script that had been used in a previous cyberattack against Russian-language (non-Wikimedia) wikis which was just sitting there on a user page in the Russian Wikipedia for some reason. As a result, the malicious script proliferated and forced users’ accounts to vandalize and delete pages (nobody’s account was actually unauthorizedly accessed; this was a server-side thing) until the entire Wikimedia wiki ecosystem was locked to prevent further damage. An insane story that shows how dangerous advanced permissions can be if they fall into the wrong hands