Any recent hacked accounts from Southperry users?

This is a good presumption. Except I would like to add that from the 'general feel' on the execution of the hackings.

It would be reasonable to say one would directly target the rich first, then the middle and so forth. I'm not saying such an attempt hasn't been tried, it might be used in conjunction on a smaller scale if success isn't imminent. The one that proves good result will probably be the more direct approach of generating hashes in order and compare each to the list of hashes of the database (if that's what the hacker is working with). The will explain the random targeting, rather than say alphatically order in terms of Nexon ID, or the chronological age of the account. (Which I assume is how the database is expanded, via account # index)..

The exact order of hacking really depends what resources the hacker is exploiting.

Since the MS website shows the characters on the account, and all you need to provide is account name + password, they could be logging each cracked password in there, and targeting higher level characters first. It's probably faster to request logins that way than through the client, and easier to run multiple logins parallel. I'm not sure if the website even has safeguards against people attempting potentially thousands of different logins a day.

If they actually have access to the DB, they could be targeting characters based on other attributes - say they found how to request mesos or equips tables, and they're just filtering by the Zakum/Scarlion/Targa Helm id# to target richer players (almost everybody has one, unlike weapons or other equip slots). Or, since they seem to make a habit of Karma-Scissoring valuable items away, maybe they request NX-cash totals.