Eurogamer found some comments from the alleged perpetrator:
"We didn't do any permanent damage," the bringer of death retaliated. "Some people liked it for a new topic of conversation and a funny stream to watch, and some people didn't. The people who didn't should be blaming Blizzard for not fixing it faster (four hours of obvious use is sad).
"It's not like I added 20,000,000 gold to everyone's inventory and broke the economy, but look at the big Chinese gold seller companies who are doing this every day. Now ask yourself who is really ruining the game. It's not us.
"That's my justification,
Another picture and video from the attacks:
Well, this is a new one. Apparently entire capital cities have been killed, NPCs and all, on certain servers by a hack/exploit. It all happened this afternoon, CET, on Tarren Mill, Ragnaros, Draenor, Twisting Nether and probably others as well. Blizzard has already addressed the issue with a hotfix:
Earlier today, certain realms were affected by an in-game exploit, resulting in the deaths of player characters and non-player characters in some of the major cities. This exploit has already been hotfixed, so it should not be repeatable. It's safe to continue playing and adventuring in major cities and elsewhere in Azeroth.
As with any exploit, we are taking this disruptive action very seriously and conducting a thorough investigation. If you have information relating to this incident, please email [email protected] We apologize for the inconvenience some of you experienced as a result of this and appreciate your understanding.
As terrible as this might be, these kinds of things actually kind of bring some much needed diversity into the game, I mean can you imagine logging in to your server one day and just finding the entirety or Ogrimmar dead? Obviously this was just malicious people doing it for the joy of annoying others, but Blizzard really could take a lesson from this (other than the usual "maybe don't leave yourselves open to exploits every single expansion") and work in secret events into the world. Or, you know, not.
Here's a few alleged videos of the hack at work (the first one seems to be from a private server, but it might be the same hack):