Pierluigi Paganini
May 26, 2026
Database extortion doesn’t look like the ransomware stories that usually grab headlines. There’s no slick branding, no leak-site countdown, no gang posting memes on Telegram. In most cases, there’s just a text file sitting inside a live database telling the victim to send bitcoin for data that’s already been copied, deleted, or both.
The Ransomnews Research Team spent five years tracking exposed databases on the public internet, from May 2021 through 13 May 2026. The dataset covers 65,907 exposed systems across MongoDB, MySQL, Elasticsearch, Kibana, and a long list of HTTP-based admin panels. Of those, 30,515 databases, or 46.3%, already carried a ransom or wipe note when researchers found them.
The scale matters because the damage isn’t theoretical. Based on pre-attack row counts, the compromised systems contained more than 215 billion records. Some were stolen, some wiped, some held for ransom.
“Mass database extortion is industrial, automated, mostly unpaid, and still doing enormous damage.” reads the report published by the Ransomnews Research Team.”The damage is identical whether the victim pays or not.”
Researchers also extracted and validated every bitcoin address found in the ransom notes. That process produced 514 distinct attacker wallets. Of the 512 wallets that could be traced on-chain through mempool.space, 318 had never received a payment. Zero bitcoin. No transaction history. Nothing.
That sounds like good news until you remember the attacks still happened. The databases were already accessed. Tables were already copied or deleted. The ransom notes were already sitting in production systems. The only missing piece was the payment.
The total confirmed revenue across the dataset came to 9.78 BTC, roughly $753,000 at the lookup price of $76,992 per bitcoin. Most of that money landed in very few hands. The top wallet captured 9.1% of all traced bitcoin payments. The top 10 wallets collected 43%. The top 50 pulled in 82.8%. The profitable end of the business is basically a small club with terrible ethics and decent automation.
The growth curve tells its own story. Researchers observed only 31 ransom-marked databases in 2021. By 2023, the number had jumped sixteen-fold. The totals flattened somewhat in 2024 and 2025, mostly because so much of the exposed database surface had already been hit. Even so, the 2026 count, measured only through mid-May, had already passed the full total for 2025. New exposed databases appear faster than old ones disappear.
One statistic cuts through the noise better than any other. Exposed MongoDB and MySQL systems were compromised almost every single time researchers found them. MongoDB showed 3,525 ransom-marked systems out of 3,532 exposed instances. MySQL was 2,930 out of 2,931. Elasticsearch and Kibana sat at roughly 98%.
At that point, exposure stops being a risk factor and starts being a status update.
“The single most useful number for a defender is the per-engine ransom rate. Of 3,532 MongoDB instances we found exposed on a default port, 3,525 were carrying a ransom note.” continues the report. “The same is true of MySQL (2,930 of 2,931), Elasticsearch (6,055 of 6,185), and Kibana (3,739 of 3,821). For these engines, exposure is not a probability of compromise. It is compromise.”
The scanners usually find exposed systems within hours. Convenience is great right up until it becomes evidence.
HTTP-based admin panels behaved differently. Only around 26% carried ransom markers because many sat behind authentication, even if the protection was weak. The real disaster zone was direct engine exposure with no auth at all.
The ransom notes themselves weren’t unique campaigns. Researchers found a small number of recycled templates pasted across tens of thousands of systems. Most databases matched more than one note family because operators constantly copied language from each other. Industrial copy-paste has apparently reached cybercrime too.
The largest note family, read_me_to_recover, appeared on 17,908 systems. Another family, btc_ransom_note, showed up on 14,714 instances and included structured bitcoin payment demands. That family gave researchers the wallet data used for the on-chain analysis. Other note types relied on plain-text instructions or privacy-focused email services like Tutanota, Proton, OnionMail, and Cock.li.
A smaller category promised decryption after payment, though that was relatively rare because most attacks focused on copying and deleting data rather than encrypting it. Another note family threatened to report victims to EU regulators for exposing customer data if they refused to pay. Apparently even ransomware operators read compliance headlines now.
The old Meow wiper campaign from 2020 barely appeared in the dataset at all. Researchers found only 53 matching notes. That shift matters because it shows how the market evolved.
“Today’s mass-extortion operators want payment, not destruction. The pure-destructive Meow strategy died because it generated no revenue.” states the report.”Even the campaigns earning zero per-victim today (the 62% above) have the option to collect from the small minority who pay. Destruction without that option does not survive.”
The automation becomes obvious when you look at wallet reuse. One bitcoin address appeared in 1,283 ransom notes tied to 1,234 victim IPs across 49 countries. Every single note demanded exactly 0.01 BTC. The campaign ran from October 2023 through May 2026 without changing the amount.
That’s not a negotiation operation. It’s a script. Scan for an exposed MongoDB instance, drop a template, ask for roughly $760, move on to the next target. The operator isn’t chasing a huge payout from one company. They’re betting enough people will pay small amounts to make the math work.
The top wallets showed the same behavior at different scales. Same payment demands. Same contact emails. Same operational patterns stretched over years. Researchers believe the apparent crowd of operators is probably just a few groups rotating wallets and infrastructure.
The contact data supports that idea. Researchers extracted around 2,100 distinct email addresses from the notes, but the highest-volume contacts appeared constantly across campaigns. One Tutanota address showed up in 1,374 notes. Another OnionMail address appeared in 1,045. The same wallet-email combinations repeated across thousands of compromised systems.
Telegram handles and Tor-based contact portals barely showed up at all. These weren’t high-touch extortion crews running negotiations around the clock. They were low-cost email campaigns designed for one-shot interactions. Pay the wallet, email the receipt, hope somebody answers before they disappear.
The geographic spread mostly followed cloud-hosting density. China topped the list with 11,874 ransom-marked databases, followed by the United States with 4,194. Germany, France, India, Singapore, South Korea, Russia, Hong Kong, and Canada rounded out the top ten. Researchers stressed that this reflects hosting volume more than national competence. A badly configured MongoDB instance behaves the same way whether it lives on a cheap VPS in Beijing or a cloud region in Virginia.
The defensive lesson is brutally simple. Don’t expose database engine ports directly to the public internet. Put them behind authentication, firewalls, security groups, allowlists, or private subnets. If an exposed MongoDB or Elasticsearch instance appears online, the odds of compromise aren’t “high.” The compromise has probably already happened.
The report also pushes back against the idea that paying ransoms makes economic sense. Most attacker wallets earned nothing. Even successful operators collected relatively small totals compared with the scale of the damage they caused. Once the note appears, the data has usually already been copied or destroyed. Offline backups and shutting the exposure down remain the least bad options.
The deeper point is uncomfortable for defenders because it cuts against the image of ransomware as a giant underground empire. Mass database extortion creates huge operational damage, but the criminal side looks surprisingly small. A handful of operators, a few reusable templates, some disposable email accounts, and a pile of scanning scripts have managed to hit more than 30,000 exposed databases worldwide.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ransomware)
