In a study published today, Comparitech researchers detail the chain of events that occured after exposing an unprotected MongoDB database (containing 1K+ synthetic customer records) to the internet. The study breaks down the experiment — covering the time it took for the database to be entirely wiped, what sorts of attacks commenced, and more.
Commenting on the findings is Justin Schamotta, Researcher at Comparitech:
“The idea that an attacker chooses a particular company to target is a pervasive one, but a lot of attacks are far less selective. Rather than setting their sights on a particular organisation, they’re often looking for any system that presents an opportunity.
This typically involves scanning large portions of the IPv4 address space to see which ports are listening. For MongoDB, a scan would query port 27017. For MySQL it would use 3306, and for Redis it would use 6379. Scripts – which take seconds to put together with the help of an LLM – can automate this process and go a step further by querying the services behind those open ports to establish whether authentication is required. There’s no need for attackers to know who owns the database, what it contains or whether it’s particularly valuable. They simply find it, exploit it and move on to the next one.
Our experiment illustrates just how little time organisations have to get this right. It took just two hours and 54 minutes for someone to find our database, wipe its contents and leave a ransom demand. We also recorded five further instances of the same wipe-and-ransom behaviour during the 48 hours it was online.
Unless your database genuinely needs to be accessed remotely, there’s no reason to expose it to the public internet in the first place. Keep it on a private network, restrict access to trusted IP addresses and, crucially, enable authentication. This makes the difference between your database being invisible to attackers and becoming another easy target.”
For full details, the research can be read here: https://www.comparitech.com/news/we-exposed-an-unprotected-database-to-the-internet-it-was-wiped-in-2-hours-and-54-minutes/
Related
This entry was posted on November 5, 2026 at 9:57 am and is filed under Commentary with tags Comparitech. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Comparitech exposed an unprotected MongoDB database to the internet. It was wiped in 2 hours and 54 minutes
In a study published today, Comparitech researchers detail the chain of events that occured after exposing an unprotected MongoDB database (containing 1K+ synthetic customer records) to the internet. The study breaks down the experiment — covering the time it took for the database to be entirely wiped, what sorts of attacks commenced, and more.
Commenting on the findings is Justin Schamotta, Researcher at Comparitech:
“The idea that an attacker chooses a particular company to target is a pervasive one, but a lot of attacks are far less selective. Rather than setting their sights on a particular organisation, they’re often looking for any system that presents an opportunity.
This typically involves scanning large portions of the IPv4 address space to see which ports are listening. For MongoDB, a scan would query port 27017. For MySQL it would use 3306, and for Redis it would use 6379. Scripts – which take seconds to put together with the help of an LLM – can automate this process and go a step further by querying the services behind those open ports to establish whether authentication is required. There’s no need for attackers to know who owns the database, what it contains or whether it’s particularly valuable. They simply find it, exploit it and move on to the next one.
Our experiment illustrates just how little time organisations have to get this right. It took just two hours and 54 minutes for someone to find our database, wipe its contents and leave a ransom demand. We also recorded five further instances of the same wipe-and-ransom behaviour during the 48 hours it was online.
Unless your database genuinely needs to be accessed remotely, there’s no reason to expose it to the public internet in the first place. Keep it on a private network, restrict access to trusted IP addresses and, crucially, enable authentication. This makes the difference between your database being invisible to attackers and becoming another easy target.”
For full details, the research can be read here: https://www.comparitech.com/news/we-exposed-an-unprotected-database-to-the-internet-it-was-wiped-in-2-hours-and-54-minutes/
Share this:
Like this:
Related
This entry was posted on November 5, 2026 at 9:57 am and is filed under Commentary with tags Comparitech. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.