VT has first submission for analysis in mid-august and 22/55 vendors convicting. from the comments, it seems like the story broke here in may:

http://news.softpedia.com/news/crooks-used-sql-injections-to...