Some 27,000 MongoDB database installations have been compromised and hijacked in a widespread ransomware attack, according to security researchers.

The attack, which started on New Year’s Day, initially saw 200 MongoDB installs compromised until growing to 2,000 by the Tuesday and then 10,500 by last Friday, until finally hitting 27,000 (and still growing) as of Jan. 9. Up to 99,000 MongoDB installs are thought to be vulnerable.

The hackers behind the attacks are targeting MongoDB installs where the databases have been left exposed because administrators failed to set up a password on the administrator account, seemingly a newbie error but oddly enough a standard configuration on a MongoDB install. Once the hackers have obtained control of the vulnerable databases, they download the content held within, delete it off the server and then leave a message asking for a ransom payment in order to return the data.

The amount of the ransom has varied, ranging from 0.1 bitcoin ($90.90) through to 1 bitcoin ($909), suggesting that there may be multiple groups behind the attacks. Two hackers named in relation to the attacks so far go by the names of harak1r1 and Kraken0, respectively.

According to Bleeping Computer, bitcoin wallets held by Kraken0 have received 70 ransom payments so far from MongoDB run sites for a total of 6.89700196 Bitcoin, or roughly $6,220. The same report also notes that there is no guarantee that those asking for a ransom actually have the database to return, so those who receive ransom demands are advised to ask for proof before paying up.

MongoDB Director of Product Security Andreas Nilsson has advised those running MongoDB installs that there are ways to protect against these attacks, besides obviously setting up a password for the admin account on their database. “If you take regular backups of the compromised database, you can restore the most recent backup,” he wrote. “If you don’t have a backup or are otherwise unable to restore the data, unfortunately your data may be permanently lost. You should assume that the attacker has a copy of all data from the affected database.”

Users who have had their databases compromised are encouraged to lodge a security incident report with MongoDB.

Image courtesy of MongoDB