"Hold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable."

Nope, because then they wouldn't be able to charge services $120/month to see if they were one of the ones compromised.

Is there a service with a billion users? :-)

All those that don't use placeholders in their SQL code.