Oh. dear. I’ve been tracking this bug and should have known that if Mt Gox got hit, so would SR. After this hit the news and I researched it, it looks like numerous SR users warned them beforehand too. It may be that these warnings tipped off the perpetrator and gave him the idea.
This is why you keep coins in your own wallet and avoid leaving them lay on third-party accounts like SR. Only transfer coins when you’re about to buy something. (but not at SR)