A database or search cluster such as MongoDB, Elasticsearch, Redis, or PostgreSQL is reachable from the internet without authentication or with default credentials, and its contents are copied, wiped, or held for ransom.
Immediate Response
1Remove public network access immediately.
2Snapshot the instance and logs for investigation before making further changes.
3Determine what data was exposed and for how long.
4Start breach notification assessment with legal and privacy teams.
