Yep. http://www.businessinsider.com/tumblr-hacked-2012-12

tl;dr: if you have a Tumblr account (and an active session), delete your cookies before opening any *.tumblr.com site.