This has been a known issue for a long time and while I hadn't seen ransomware before these open databases have been attacked previously: https://blog.shodan.i

This has been a known issue for a long time and while I hadn't seen ransomware before these open databases have been attacked previously: https://blog.shodan.io/its-the-data-stupid/ https://blog.shodan.io/its-the-data-stupid/ Note that MongoDB listens on localhost unless changed by the user or the developer is using an insecure image.