22,900 MongoDB Databases Affected in Ransomware Attack

Nearly 23,000 MongoDB databases are affected in a ransomware campaign designed to wipe information from misconfigured databases lacking password protection, ZDNet reports.

The attacker reportedly used an automated script to scan for exposed databases. When it found one, the script deleted the contents and uploaded a ransom note demanding 0.015 bitcoin to retrieve them. If the victim doesn't pay in two days, the attacker threatens to publish their information and report them to their local GDPR enforcement authority, the report states. 

This attack is the latest in a series of incidents conducted by attackers who profit from wiping exposed MongoDB databases and demanding ransom. In January 2017, a cluster of attacks against MongoDB servers affected more than half of Internet-facing MongoDB databases. Unprotected MongoDB databases have been a source of multiple leaks and breaches, including last year's attack on Choice Hotels and a massive exposure of 763 million email addresses.

Security admins worried about protecting their assets can consult MongoDB's Security Checklist, which contains a list of steps to better protect databases. 

Read more details here.

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.