Once in 2007 when I was 14,I was running a RealVNC server on a computer with the default port forwarded. Around the same time, unknown to me, a buffer overflow exploit was released for the particular version of RealVNC that I had. Some kid eventually found it, and proceeded to do stupid things on my computer (IM my friends, change my background, etc). Luckily nothing of any importance was lost.
Another time, in 2006, I had a shell account on my friend's Linux server. At the time I was using it to host a Wordpress blog. My friend was running an outdated version of PhpMyAdmin, and it was exploited. The guy who got in dumped all of the databases, and on top of that, e-mailed us screenshots of him doing it. :/
Thankfully, all of the users had recent enough backups to deal with.