The Hidden Ransomware Economy Running on Exposed Databases

A five-year Ransomnews study documents industrialized mass database extortion: researchers found 30,515 exposed databases bearing ransom or wipe notes (out of 65,907 exposed systems), representing over 215 billion records; attacks were highly automated, low-touch, and often unpaid, with 514 distinct attacker wallets identified and a handful of wallet-email templates reused across thousands of victims — the report urges defenders to stop exposing database ports and rely on backups, authentication, and network controls.