It sounds like the leak is just the mongodb instances being open to incoming traffic from the internet without authentication. This a common problem with MongoD

It sounds like the leak is just the mongodb instances being open to incoming traffic from the internet without authentication. This a common problem with MongoDB, because its default configuration is insecure.