A recent security incident that began as an email leak exposed more than 2 billion records containing email addresses and other personal information.

On Feb. 25, Security Discovery came across a MongoDB instance left unprotected by a password on the internet. Security researcher Bob Diachenko peered inside the exposed resource and discovered 150 GB of data, including just under 800 million email addresses. Some of the records also included personally identifiable information (PII) such as dates of birth, gender and phone numbers.

As it turned out, the scale of the incident was much larger than originally reported. Andrew Martin, CEO and founder of DynaRisk, told SC Media UK that his company’s analysis revealed how the security incident had exposed four databases, not just one. These databases contained a total of 2,069,145,043 records, with some of the files holding employment information among other pieces of data. DynaRisk also determined that all of the records were unencrypted at the time of exposure.

A Stream of MongoDB Security Events

This isn’t the only large data breach to make headlines in 2019. Near the beginning of the year, security researcher Troy Hunt revealed how the Collection #1 breach had exposed nearly 800 million email addresses and more than 21 million passwords. Shortly thereafter, PCWorld reported that the Collection #1 data breach was part of a larger set of security incidents. With the addition of Collections #2–#5, the “Collections” breaches exposed a total of 2.19 billion records.

The incident found by Security Discovery isn’t the only one to involve an unsecured MongoDB, either. In September 2018, for instance, Diachenko revealed how an unprotected MongoDB instance had exposed 11 million records. Several months later, ZDNet found that digital attackers were still holding unsecured MongoDB databases for ransom — two years after these types of security incidents first began.

How to Defend Against a MongoDB-Based Email Leak

Security professionals can help defend their organizations’ MongoDB databases from an email leak by tailoring data encryption to fit their needs, such as by combining storage-level encryption for performance and structured data encryption on certain high-risk apps. Organizations should also implement other MongoDB security best practices, which include enabling access control and auditing system activity.

More from

Will the 2.5M Records Breach Impact Student Loan Relief?

Over 2.5 million student loan accounts were breached in the summer of 2022, according to a recent Maine Attorney General data breach notification. The target of the breach was Nelnet Servicing, a servicing system and web portal provider for the Oklahoma Student Loan Authority (OSLA) and EdFinancial. An investigation determined that intruders accessed student loan account registration information between June and July 2022. The stolen data includes names, addresses, emails, phone numbers and social security numbers for 2,501,324 student loan…

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…

Inside the Second White House Ransomware Summit

Ransomware is a growing, international threat. It's also an insidious one. The state of the art in ransomware is simple but effective. Well-organized criminal gangs hiding in safe-haven countries breach an organization, find, steal and encrypt important files. Then they present victims with the double incentive that, should they refuse to pay, their encrypted files will be both deleted and made public. In addition to hundreds of major attacks around the world, two critical ransomware incidents — the Colonial Pipeline…

Did Brazil DSL Modem Attacks Change Device Security?

From 2011 to 2012, millions of Internet users in Brazil fell victim to a massive attack against vulnerable DSL modems. By configuring the modems remotely, attackers could redirect users to malicious domain name system (DNS) servers. Victims trying to visit popular websites (Google, Facebook) were instead directed to imposter sites. These rogue sites then installed malware on victims' computers. According to a report from Kaspersky Lab Expert Fabio Assolini citing statistics from Brazil's Computer Emergency Response Team, the attack ultimately…