China. The Chinese have the most to gain from penetrating the IMF's databases. They've been shopping for European debt for some time, both to seek discounted value (Greece, et alia) and to diversify away from investments in a shaky U.S. dollar. They certainly have the computing horsepower and brainpower to pull off this kind of stunt. Motive + Means + Opportunity = fun speculation.
Russia. Other BRIC nations have money to spend and agendas to advance. Some in the post-Soviet Russian establishment have never gotten over the humiliation of losing the cold War. The IMF is a leading institution identified with the American power.
Non-state entities. Here's where wild cards can come into play. Big hedge funds have plenty of computing power at their disposal. Some hedge fund executives may just be amoral enough to authorize a little extracurricular adventure for their whiz-kid traders. A small, tight team of computer PhDs could probably whip up a spear phishing algorithm in their spare time between arbitraging yield differentials. The motivation is obvious. Getting a special look at sovereign debt valuation metrics confers the ultimate inside trading advantage. The fact that such action is illegal on so many different levels won't deter a determined hedge fund team staring redemptions in the face.
This is all guesswork on my part. I have no idea who did this and I condemn any such action. Hacker shenanigans make it harder for honest investors like yours truly to operate.