Over 12,000 unsecured MongoDB databases have been deleted over the past three weeks, with only a message left behind asking the owners of the databases to contact the cyber-extortionists to have the data restored. Attackers looking for exposed MongoDB servers using BinaryEdge or Shodan search engines delete them and demand a ransom for their’restoration services. This campaign does not seem to request a specific ransom amount. Instead, email contact is provided, most likely to negotiate the terms of data recovery.
Source: https://www.bleepingcomputer.com/news/security/over-12-000-mongodb-databases-deleted-by-unistellar-attackers/