The hack announced by @RootError himself on his official Twitter account, reason of hacking still unknown.
List of Hacked Sites:
List of hacked sites can be found here.
Deface Message:
Defaced by @rooterror.. Break Security Hackers.. The network security is a myth..
Zone-h Mirror:
http://www.zone-h.org/archive/notifier=rooterror
All Hacked sites are hosted on the same Server. According to Whois, Name Servers of hacked sites by IP address
ns1.cyrushost.com 184.107.137.34
ns2.cyrushost.com 184.107.137.35
Anatomy of an attack is not yet clear but having sites on the same server, it seems that the attacker might access one site then hacked multiple sites with Symlink.
The server is not rooted because according to Reverse IP Domain Check, more than 127 sites are hosted on the server and the attacker able to hack 87 sites.
The targeted sites mostly belong to private business based in Canada, such as travel agencies, real estates, web development and cloths designing agencies.