> series: anatomy_of_a_breach —— part: 097 —— targets: 28,000+_databases —— authentication: none —— skill_required: zero<span class="cursor-blink">_</span>_
In early January 2017, security researcher Victor Gevers reported that attackers had begun systematically targeting MongoDB databases exposed to the internet without authentication. The attack was simple: connect to an exposed database, delete the data, leave a ransom note in a new collection demanding 0.2 Bitcoin (approximately $200) for the data's return, and move on to the next target. Within weeks, over 28,000 MongoDB instances had been ransomed. The wave quickly expanded to include Elasticsearch, Hadoop, CouchDB, and Cassandra deployments — any database technology that could be deployed without default authentication.
The MongoDB ransomware wave was not a sophisticated attack — it was an automated scan for databases with no passwords, followed by deletion and extortion. Many of the ransomed databases contained production data: customer records, application data, research datasets, and healthcare information. In many cases, the attackers did not actually preserve the data — meaning victims who paid the ransom received nothing in return. The wave demonstrated a new threat paradigm: misconfiguration at internet scale is a vulnerability class as dangerous as any software flaw.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe MongoDB wave established that misconfiguration is a first-class vulnerability — as exploitable and as damaging as any software flaw. For organisations deploying databases, cloud services, or any internet-facing infrastructure, security configuration must be verified through testing, not assumed through policy. Cyber Essentials mandates secure configuration as a baseline control. Our infrastructure testing and cloud configuration reviews identify exposed services. SOC in a Box monitors for unauthorised access to database services. And UK Cyber Defence provides incident response when misconfigured services are discovered or exploited.
Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> finds unauthenticated services. <a href="/penetration-testing/cloud-configuration-review">Cloud reviews</a> check your cloud estate. <a href="/cyber-essentials">Cyber Essentials</a> mandates secure configuration.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call