Looks like there was an attack that hijacked 300+ Tor relay nodes, promoted them to exit nodes (to become 10+% of the count of exit nodes at the time), and was then discovered and stopped. Roughly, detected on October 2nd and resolved by October 5th.
I wonder if any of us can observe the churn in the Tor population of relays and exits in our own data. I haven’t spend much effort yet looking at connection churn on my setup, but I think others have.
