no, more like someone's instance gets pwn-ed and is now part of a botnet and DO is getting calls and or isp-blocked and has to devote staff time to the incident.