I read that article last night and was wondering if someone here was going to point out how the 12m figure is made up.

Were there compromised sites? Sure, but I would be surprised if it were more than an order of magnitude less than what the bbc reported. That is still a lot of sites, but not a monumental cluster-fsck that the aftermath is being made out to be.