22,900 MongoDB Databases Affected in Ransomware Attack

An attacker scanned for databases misconfigured to expose information and wiped the data, leaving a ransom note behind.

Nearly 23,000 MongoDB databases are affected in a ransomware campaign designed to wipe information from misconfigured databases lacking password protection, ZDNet reports.
The attacker reportedly used an automated script to scan for exposed databases. When it found one, the script deleted the contents and uploaded a ransom note demanding 0.015 bitcoin to retrieve them. If the victim doesnt pay in two days, the attacker threatens to publish their information and report them to their local GDPR enforcement authority, the report states.
This attack is the latest in a series of incidents conducted by attackers who profit from wiping exposed MongoDB databases and demanding ransom. In January 2017, a
cluster of attacks
against MongoDB servers affected more than half of Internet-facing MongoDB databases. Unprotected MongoDB databases have been a source of multiple leaks and breaches, including last years
attack
on Choice Hotels and a massive
exposure
of 763 million email addresses.
Security admins worried about protecting their assets can consult MongoDBs
Security Checklist
, which contains a list of steps to better protect databases.
Read more details
here
.
A listing of
free products and services
compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
22,900 MongoDB Databases Affected in Ransomware Attack