Threat actors are exploiting exposed MongoDB servers, demanding ransoms around $500 in Bitcoin to restore compromised data. A recent study found over 208,500 public MongoDB instances, with many already wiped and ransom notes left behind. Security experts recommend stronger authentication and regular updates to prevent these attacks.