I always find it funny when people call it a SQL Injection Bug. Since you have to enable it by coding your site in specific unsafe ways, I prefer to think of it as a SQL Injection "feature".

A threat group named 'ResumeLooters' has stolen the personal data of over two million job seekers after compromising 65 legitimate job listing and retail sites using SQL injection and cross-site ...