Over 1,400 MongoDB Databases Ransacked by Threat Actor

Back Feeds.Feedburner

Over 1,400 MongoDB Databases Ransacked by Threat Actor

Feeds.Feedburner •Ionut Arghire • February 2, 2026

Share: View original

Of 3,100 unprotected MongoDB instances, half remain compromised, most of them by a single threat actor.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Automated Ransomware Campaigns Target MongoDB Instances Threat actors are conducting large-scale ransomware attacks on unsecured MongoDB instances. These attacks involve scanning for publicly accessible databases, deleting their contents, and placing ransom notes demanding Bitcoin payments. The campaigns are reported to be highly profitable despite relatively low ransom demands. 13 sources 31

Extracted Entities

Attack Types (2)

Data Breach Ransomware

Platforms (1)