It looks like one of my sites has been compromised with an SQL injection. All the channel entries have been closed, which amounts to over 5k entries.
I restored the database with a previous daily backed, so all is well again, but have no idea what could have caused this, seems most likely to be a rogue sql query as no way to accidentally change all open statuses to closed in the CP.
I have added in extra security by changing passwords, system directory name, removed some add-ons, switched XSS filter back, check permissions, etc.
The site's still on 1.7 and Ellislab have had a look around the CP and say they can't see any evidence of a virus.
I'd be very interested to hear if anyone has had a similar experience.