MongoDB Security Incident Update, December 20, 2023

MongoDB
December 21, 2023 | Updated: January 3, 2024

The following is an update on the security incident first reported on December 16, 2023, US Eastern time (EST). For all critical alerts and advisories for MongoDB, please visit mongodb.com/alerts.

We continue to find no evidence of unauthorized access to MongoDB Atlas clusters or the Atlas cluster authentication system.

Based on the investigation to date, the unauthorized third party used a phishing attack to gain access to some of the corporate applications that we use to provide support services to MongoDB customers. In collaboration with outside forensic experts, we currently have a high level of confidence that the unauthorized third party has been removed from our corporate applications and that this incident is contained.

Although our investigation remains ongoing, today we’re sharing additional information regarding the contact information and related account metadata that we have identified as having been exposed. The tables below show the relevant fields.


CRM Application

Field Name Description
Salutation
First Name
Last Name
Title
Account Name Company Name
Address Street
Address City
Address State
Address Zip
Address Country
Phone 1 Primary Phone
Phone 2 Mobile
Phone 3 Fax
E-Mail
Owner Full Name MongoDB Sales Contact

Customer Support Application

Field Type Description
User Name String Username / email address for account.mongodb.com
Last Auth Date/Time Time of last user authentication
Last Auth Method String Last authentication method used
Time Zone ID String ID for user's preferred time zone
Time Zone Code String Alphabetical code for user's preferred timezone
Created Date/Time User registration time
First Name String User first name
Last Name String User last name
User ID String Internal unique user identifier
Is Invite Boolean User invited but has not yet accepted invite
Read Only Boolean User has limited permissions
Last Page View Date/Time Last time a page was viewed by user
Login Count Number Number of times a user has logged in
Is Locked Boolean Indicates if user is locked, automatically or manually
Is Deleted Boolean Indicates if user has been deleted
Deleted Date Date/Time Time at which the user was deleted
Email Last Verified Date/Time Email verification date
Email Needs Verification Boolean Email needs verification
Email Address String Alternate email address
Has Account Multifactor Auth Boolean User is enrolled for multifactor authentication
Deprecated Fields The fields below are only populated for users of our deprecated multifactor authentication (MFA) system. We released our current MFA system in January 2021.
Multifactor Auth Phone String Phone number used for deprecated MFA
Multifactor Auth Extension String Phone number extension used for deprecated MFA
Multifactor Auth Backup Phone String Alternate phone number used for deprecated MFA
Multifactor Auth Backup Phone Extension String Alternate phone number extension used for deprecated MFA
Multifactor Auth Authenticator Boolean Specifies whether an authenticator device was used for deprecated MFA
Multifactor Auth Voice Boolean Specifies whether a user of deprecated MFA wished to receive voice calls
Unused Fields The following fields are no longer in use by any system.
Multifactor Auth Update Key String May be populated for users of deprecated MFA. Field is not used by any system.
Team IDs String[] Empty and unused
Num Teams Number Empty and unused
Status String Empty and unused
Num Groups Number Empty and unused
Internal Fields
Roles String[] Internal field, populated only for MongoDB employee records
Roles String String Internal field, populated only for MongoDB employee records

In addition, we previously disclosed a list of indicators of compromise (IOCs) from which we detected unauthorized activity; that list is shared again below. Pursuant to industry best practices, we recommend that customers take the following actions using this information:

  • Provide this list of IOCs to your security or infrastructure teams. These teams can proactively set up firewall blocks or monitoring, as appropriate.

  • Search your application or infrastructure logs for these addresses to identify possible anomalous activity.

  • Please be aware that threat actors will regularly change IP addresses, therefore this list is not exhaustive.


Indicators of Compromise (IOC)

107.150.22.47
138.199.6.199
146.70.187.157
179.43.189.85
185.156.46.165
198.44.136.69
198.44.136.71
198.44.140.133
198.44.140.199
199.116.118.207
206.217.205.88
66.63.167.152
66.63.167.154
87.249.134.10
96.44.191.132

We also continue to recommend that customers be vigilant for social engineering and phishing attacks, activate phishing-resistant, multifactor authentication (MFA), and regularly rotate their passwords. To learn how you can enable phishing-resistant MFA on MongoDB’s native cloud authentication service, read our documentation on managing MFA options. MongoDB Cloud also supports federating your identity from your IDP, and you can read about configuring federated authentication here.

Moving forward, MongoDB will post updates to mongodb.com/alerts when we have notable new information.

Update as of January 3, 2024: The investigation of this incident is complete and closed. Please see the MongoDB Alerts page for more information.

← Previous

Two Keys To AI’s Future: What We Heard From Developers At AWS re:Invent 2023

At AWS re:Invent 2023, we chatted with numerous developers about the thing everyone was talking about. Which was… drum roll AI. Specifically, Generative AI. So much has happened over the last year in this space. LLMs have gone from being primarily a field of academic research to something every developer, product engineer, IT decision maker, C-level executive (and everyone in between) is thinking about. Questions that have emerged in that time—in the news, at tech conferences, in conversations with developers, among colleagues, in blog articles, etc.—include: Are we in a hype cycle? Is this just another fad? Is AI, after a series of promising starts and then long winters, here to stay for real this time? And if so, how can an organization use Generative AI to disrupt the market instead of being disrupted? We chatted with several developers at AWS re:Invent to get a sense of what they were thinking about when it comes to Generative AI. Here’s some of what they had to say: "[Generative AI] will help people build faster and safer, but [it’s] definitely not going to replace everything." - Developer "I'm excited about all the tools that can help developers to develop faster, like CodeWhisperer." - Head of Cloud Operations "Generative AI is here to stay." - Chief Technology Officer The theme throughout these quotes is how Generative AI will benefit developers in the work they do. Specifically, how Generative AI will help them develop faster and easier. A prime example of this is, as one of those quotes above notes, Amazon CodeWhisperer, which boosts developer productivity through AI-driven code assistance. The data used to train Generative AI code assistants, like Amazon CodeWhisperer, is key, though. This is why MongoDB collaborated with the Amazon CodeWhisperer Data Science team to train CodeWhisperer’s foundational model on MongoDB use cases to give developers the best possible code suggestions. In addition to helping developers do their work faster and easier, advancements in Generative AI are also empowering developers—specifically developers with more limited backgrounds in AI/ML—to use LLMs more effectively in their applications. In fact, it’s now easier than ever for developers to build AI-powered apps. As one data engineer at AWS re:Invent 2023 said: “Generative AI enables people that have no experience in AI to start entering this industry to use their domain knowledge to explore the applications.” A good example of this is Retrieval-Augmentation Generation or RAG. MongoDB’s Mat Keep writes in a recent blog article : “As recently as 12 months ago, any mention of retrieval-augmented generation (RAG) would have left most of us confused. However, with the explosion of generative AI, the RAG architectural pattern has now firmly established itself in the enterprise landscape.” RAG presents developers with a potent combination. They can take the incredible knowledge and reasoning capabilities of pre-trained, general purpose Generative AI models and feed them with accurate and up-to-date company-specific data. This means developers can build AI-powered apps that generate outputs grounded in enterprise data and knowledge without having to turn to specialized data science teams to train or fine-tune models — which is a complex, time-consuming, and expensive process. RAG is one of many examples of how development tools and technologies are changing to allow developers to build AI confidently and securely. When you look at all of the above, it’s very clear that this new revolutionary era of Generative AI is driven by empowered developers. Still, because there are so many incredible advances in both commercial and open-source Generative AI models, and because everyone has access to these, the real differentiation comes down to something unique to every organization: data. One question we’re left to ask is: What will developers be talking about with respect to Generative AI at AWS re:Invent in the coming year? As we’ve seen over the last twelve months, a lot can happen and change. So there’s no exact telling what the future will hold. But what is clear is that the two key things that will determine Generative AI’s future will continue to be data and developers. To learn more, check out our resources page for building AI-powered apps .

December 19, 2023
Next →

MongoDB Database Observability: Integrating with Monitoring Tools

This post is the final in a three-part series on leveraging database observability. Welcome back to our series on Leveraging Database Observability! Our previous post showcased a real-world use case highlighting how MongoDB Atlas’s observability tools effectively tackle database performance challenges. Whether you’re a developer, DBA, or DevOps engineer, our mission is to empower you to harness the full potential of your data through our observability suite . Integrating Atlas metrics with your central enterprise observability tools can simplify your operations. By seamlessly working with popular observability tools, our approach helps teams streamline workflows and enhance visibility across systems. Integrating MongoDB Atlas with third-party monitoring tools MongoDB’s developer data platform combines all essential data services for building modern applications within a unified experience. Our purpose-built observability tools for Atlas environments offer automatic monitoring and optimization, guiding diagnostics tailored specifically for MongoDB. Additionally, we extend Atlas metrics into your existing enterprise observability stack, enabling seamless integration without replacing your current tools. This creates a consolidated, single-pane view that unifies Atlas telemetry with other tech and application metrics, ensuring comprehensive visibility into both database and full-stack performance. This integration empowers you to monitor, receive alerts, and make data-driven decisions within your existing workflows, driving greater efficiency. Below is a quick guide to modifying integration settings through the Atlas UI and the popular integrations we support: Navigate to the Project Integrations page in Atlas. Choose the organization and project you want to configure from the navigation bar. On the Project Integrations page, select the third-party services you’d like to integrate. Configure the chosen services with the required API keys and regions. Critical integrations for your observability platform With Atlas’s Datadog and Prometheus integrations, you can send critical MongoDB metrics to these platforms, empowering detailed, real-time monitoring. Through Datadog , you can track database operation counts, query efficiency, and resource usage, ideal for pinpointing bottlenecks and managing resources. Similarly, Prometheus enables you to monitor essential metrics like query times, connection rates, and memory usage, supporting flexible tracking of database health and performance. Both integrations facilitate proactive detection of issues, alert configuration for resource thresholds, and a cohesive view of Atlas data when visualized in Grafana. Atlas’s integration with PagerDuty streamlines incident management by sending metrics like performance alerts, billing anomalies, and security events directly to PagerDuty. This integration records incidents automatically, notifies teams upon alerts, and supports two-way syncing, ensuring resolved alerts in Atlas are reflected in PagerDuty. It enables efficient incident response and resource allocation to maintain system stability. With Atlas integrations for Microsoft Teams and Slack, you can route key metrics—such as query latency, disk usage, and throughput—to these channels for timely updates. Teams can use these insights for real-time performance monitoring, incident response, and collaboration. Notifications through these platforms ensure your team stays informed on database performance, storage health, and user activity changes as they occur. Use case: Centralized observability with MongoDB Atlas, Datadog, and Slack Let’s walk through a hypothetical scenario for ShopSmart, an e-commerce company that leverages MongoDB Atlas to manage its product catalog and customer data. As traffic surges, the DevOps team faces challenges in monitoring application performance and database health effectively. To tackle these challenges, the team leverages MongoDB Atlas’ integration with Datadog and Slack, creating a powerful observability ecosystem. Integrating MongoDB Atlas with Datadog: The team pushes key MongoDB Atlas metrics into Datadog, such as query performance, connection counts, and Atlas Vector Search metrics. With Datadog, they can visualize these metrics and correlate overall MongoDB performance with their other applications. Out-of-the-box monitors and dedicated dashboards allow the team to track metrics like throughput, average read/write latency, and current connections. This visibility helps pinpoint bottlenecks in real time, ensuring optimal database performance and improving overall application responsiveness. Setting up alerts in Datadog: The team configures alerts for critical metrics like high query latency and increased error rates. When thresholds are breached, Datadog instantly notifies the team. This proactive approach allows the team to address potential performance issues before they impact customers. Integrating Datadog with Slack: To ensure fast communication, alerts are sent directly to the dedicated Slack channel, “ShopSmart-Alerts.” This integration fosters seamless collaboration, enabling the team to discuss and resolve issues in real-time. With these integrations, ShopSmart’s engineering team can monitor performance quickly and address issues efficiently. The unified observability approach enhances operational efficiency, improves the customer experience, and supports ShopSmart’s competitive edge in the e-commerce industry. By leveraging MongoDB Atlas, Datadog, and Slack, the team ensures scalable performance and drives continuous innovation. Conclusion MongoDB Atlas empowers developers and organizations to achieve unparalleled observability and control over their database environments. By seamlessly integrating with central enterprise observability tools, Atlas enhances your ability to monitor performance metrics and ensures you can do so within your existing workflows. This means you can focus on building modern applications confidently, knowing you have the insights and alerts necessary to maintain optimal performance. Embrace the power of MongoDB Atlas and transform your approach to database management—because your applications can thrive when your data is observable. And that wraps up our Leveraging Database Observability series! We hope you learned something new and found value in these discussions. Sign up for MongoDB Atlas , our cloud database service, to see database observability in action. To dive deeper and expand your knowledge, check out this learning byte for more insights on the MongoDB observability suite and how it can enhance your database performance.

November 14, 2024