Extortionists Wipe Thousands of Databases, Victims Who Pay Up Get Stiffed
Summary: Tens of thousands of publicly accessible MongoDB databases have been wiped and replaced with ransom notes, with researcher Niall Merrigan estimating at least 29,000 erased and Flashpoint's Zach Wikholm confirming at least 20,000 deleted, possibly permanently. Merrigan and Victor Gevers found that multiple fraudsters are overwriting each other's ransom notes, so virtually none of the victims who paid have received their files back.
What you should know: Paying buys nothing here: with competing extortionists swapping notes on the same wiped databases, victims have no way to know who holds the original data, and Merrigan is advising against payment. The attackers needed only a Shodan query and anonymous access to reach over 52,000 exposed MongoDB instances, most of them in the United States.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026