I just got a Vulpix with Drought from the GTS. Is there a legit way to get one? I haven't heard of anything being hacked yet (it came from Japan).
edit: Looks like pokemon caught in the friend safari can have hidden abilities. This thing is the right nature and has "relatively superior" IVs, so I'm hoping it came from a hardcore breeder.