The Wall Street Journal story says unnamed sources claim the attackers were able to take source code for Windows and Office, along with other sensitive corporate data, and that the code was e-mailed to St. Petersburg, Russia. Again, Microsoft has yet to confirm or deny this. Having source code to Microsoft's main products has staggering implications. Rogue copies or offshoots of the software could be sold on the black market. Competitors might also gain insight into Microsoft's product design secrets.
Developers do that all the time.
The weak point is probably human. Even the best software can't stop a human from being daft. Meanwhile, ISS has put out the Severity 5 alert for a security hole in Internet Information Server versions 4 and 5. Attackers may use the Unicode character set to craft URLs that access resources via IIS that normally would be inaccessible. Microsoft inadvertently fixed the problem with a security patch issued last August that was meant to repair another security vulnerability.