Nearly 23,000 MongoDB databases are affected in a ransomware campaign designed to wipe information from misconfigured databases lacking password protection, ZDNet reports.
The attacker reportedly used an automated script to scan for exposed databases. When it found one, the script deleted the contents and uploaded a ransom note demanding 0.015 bitcoin to retrieve them. If the victim doesn’t pay in two days, the attacker threatens to publish their information and report them to their local GDPR enforcement authority, the report states.
How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%
This attack is the latest in a series of incidents conducted by attackers who profit from wiping exposed MongoDB databases and demanding ransom. In January 2017, a cluster of attacks against MongoDB servers affected more than half of Internet-facing MongoDB databases. Unprotected MongoDB databases have been a source of multiple leaks and breaches, including last year’s attack on Choice Hotels and a massive exposure of 763 million email addresses.
Read more: Dark Reading
