Hackers Attacking MongoDB Instances to Delete Database and Add Ransom Note

Cybersecuritynews •Abinaya • February 2, 2026

Threat actors are actively targeting internet-exposed MongoDB instances in large-scale automated ransomware campaigns. The attacks follow a consistent pattern: attackers scan for unsecured MongoDB databases accessible on the public internet, delete the stored data, and insert ransom notes demanding payment in Bitcoin. Recent evidence indicates these campaigns remain highly profitable despite modest ransom demands typically […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Automated Ransomware Campaigns Target MongoDB Instances Threat actors are conducting large-scale ransomware attacks on unsecured MongoDB instances. These attacks involve scanning for publicly accessible databases, deleting their contents, and placing ransom notes demanding Bitcoin payments. The campaigns are reported to be highly profitable despite relatively low ransom demands. 13 sources 31

Hackers Attacking MongoDB Instances to Delete Database and Add Ransom Note

The full story

Extracted Entities

Attack Types (1)

Platforms (1)