Integration Pack Connector settings wiped and replaced

Question

Greetings all,
I've just experienced a rather concerning issue and have hit a bit of a dead-end trying to identify the root cause.
We have Orchestrator 2012 R2 with several 3rd party integration packs from codeplex such as ones for Sharepoint, AD, Config Manager etc.
Sharepoint IP - http://orchestrator.codeplex.com/releases/view/75877
The other night several runbooks stopped working and we found that ALL of the Integration Pack configuration settings for our SharePoint IP had been completely wiped and two completely unknown entries configured there instead.
From what I can tell, "ybusa.net" refers to YellowBook, which isn't even remotely related to us. The username and Sharepoint site URL are also completely unknown to us. The closest I reference I can find is that Yellowbook is mentioned a few times
as a reference customer for Opalis, and this codeplex post - http://scorch.codeplex.com/discussions/455038
I tried searching the sourcecode of the Sharepoint integration pack but could find no reference to ybusa or YellowBook.
The best guess I can come up with is that an integration pack we are using was written by someone while they were working for Yellowbook, and somehow there is a bit of "default" configuration data buried in the IP or a common binary somewhere that
was triggered somehow and caused this to happen.
It was not the only IP that had configuration settings lost and replaced with strange "default" entries, but not all of the IP's were affected (e.g. official Microsoft ones). So I was wondering if there is a connection between the author of the
impacted IP's and YellowBook.
We were able to restore the database to a point just before the change happened and everything is now back to normal, but as we can find no trigger, cause or connection to why it happened at all, this is now making us rather nervous about the fact it may
happen again.
We've been using these same IP's for quite some time now (>6 months) and there also have been no updates of SCORCH or any Integration packs performed in quite some time.
Any thoughts or suggestions that might help solve this mystery would be most welcome.
Regards,
Scott.

Answer 1

We have a answer - almost forgot to post a follow up about what happened.
The most important thing I learned from this is that importing Configuration configurations will entirely replace any config data that is already present for an Integration Pack.
The culprit was in fact the import of the "SC2012 Solution Runbook Examples" which also applies settings across several Integration Packs.
http://orchestrator.codeplex.com/releases/view/86195
Digging through that code you can see the references to YellowBook.
A colleague has been testing export and import of his own runbooks (which I had checked and cleared as OK), but somewhere along the way he selected the Solutions one. At the time he didn't realise as it imported into a test sub folder that was being frequently
deleted and re-created. He has now been banished to the DEV environment pending a rigorous re-education program :)
So from this I now know:
We have a pretty good DR capability for Orchestrator
Importing has "Global Configurations" enabled by default and will REPLACE all existing config data for matching IPs. The documentation guides I've written for the people here say to unselect the import of Global configurations. That unfortunately
is no protection against Orchestrators desire to make it enabled by default
even more about the Orchestrator DB schema and how to follow the internal object GUIDs to find all the connections they have to each other
Orchestrator still has many many quirks that really need Microsoft to spend some time improving on
Thank you all for your feedback and suggestions.