I think the post explains it awfully - not in a way I can digest on my lunch break, since I have no idea what LJ-toys even is.

Also, any security breach should go out as a push communication to all users; it's shameful to be finding this out on a random check of my friends page.

One of the many reasons I took my blog-eggs out of the LJ basket some time ago.