I haven't had time to follow this as much today (after spending last night either uninstalling TeamViewer or remotely disabling the TeamViewer service on a bunc

I haven't had time to follow this as much today (after spending last night either uninstalling TeamViewer or remotely disabling the TeamViewer service on a bunch of systems), but what I was reading yesterday seemed like everyone hit was using a registered account instead of just direct connections using codes. That makes me think that perhaps something's compromised some of their account information (manageable through the website, etc.) rather than the remote control infrastructure itself.