The why of this attack is still unknown, but the how has been (poorly) explained some of Blizzard's moderators.
"Earlier today, certain realms were affected by an in-game exploit, resulting in the deaths of player characters and non-player characters in some of the major cities. This exploit has already been hotfixed, so it should not be repeatable. It's safe to continue playing and adventuring in major cities and elsewhere in Azeroth," one of them stated, and asked users who might have information relating to this incident to get in touch with Blizzard.
Surprisingly unfazed, many players piped up with their own theories about the incident, saying that it was the result of a hack that allowed hackers to use spells that kill everything within a certain range, speculating that the hack was executed by users who wanted to force Blizzard to fix the flaw fast, or simply expressing regret that they missed the bloodbath.