Exposed MongoDB instances still targeted in data extortion attacks

Researchers observed an automated extortion campaign targeting misconfigured, publicly exposed MongoDB instances: attackers accessed unsecured databases (approximately 3,100 without authentication), wiped or removed data on many (~45.6% of unrestricted instances, roughly 1,400 compromised), and left ransom notes demanding ~0.005 BTC (~$500), with most notes directing payments to one of five wallet addresses—suggesting a focused criminal operator exploiting poor authentication, outdated software, and exposed deployments.