Unknown hackers compromised 333 Tor exit relays for three days in October, redirecting SSH connections through 12 interceptor servers and favoring unencrypted email traffic. The breach began with a reused password and involved the Linux backdoor Ebury.