By any chance, could there be some relation with the test servers you had recently set up ? Could their IPs have been nearby the IPs of the main servers, therefore giving some direction for location to the vandals ?