I have not seen a list or a count on the number of sites, but they almost all have to due with the install directory not being deleted.
To recover, please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
Also please see these recent security announcements:
vBulletin 4.1.x-4.2.x & All versions of vBulletin 5:
http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue:
http://www.vbulletin.com/forum/forum...d-all-versions