Attackers are exploiting misconfigured open-source MongoDB databases and holding them for ransom. The ransomware attacks against MongoDB were first publicly reported by GDI Foundation security researcher Victor Gevers on Dec. 27, 2016, and have been steadily growing ever since, with at least five different groups of hackers taking control of over 10,000 database instances.
Among the most recent groups to join the MongoDB ransomware attack was one reported on Jan. 6, by security researcher Nial Merrigan. The MongoDB attackers are only identified by the email address that is used to demand payment.