Industrial-Scale Database Extortion: A Five-Year Census Reveals Massive Damage with Minimal Payoff A five-year investigation by the Ransomnews Research Team uncovered a staggering scale of exposed databases on the public internet 65,907 instances with 46.3% (30,515) already compromised by ransom or wipe attacks. The study, conducted between May 2021 and May 2026, traced 514 distinct Bitcoin wallets linked to these attacks, revealing a stark imbalance: 62% of wallets received no payments, yet the damage an estimated 215 billion records destroyed or exfiltrated was already done. ### Key Findings - Exposure = Compromise: Nearly 100% of exposed MongoDB, MySQL, Elasticsearch, and Kibana instances carried ransom notes when observed, proving that unsecured databases are almost immediately targeted. - Automated, Low-Effort Attacks: A single Bitcoin wallet appeared in 1,283 ransom notes across 49 countries, demanding 0.01 BTC (~$760) a clear sign of scripted, volume-driven extortion. - Concentrated Profits: Of the 9.78 BTC (~$753,000) paid across five years, the top 10 wallets captured 43%, while the top 50 took 82.8%. Most operators earn little, but a few dominate the profitable end. - Shift from Destruction to Extortion: Early "wiper" attacks (like the 2020 Meow campaign) have nearly vanished, replaced by ransom notes even if most victims don’t pay. ### How the Attacks Work - Industrial-Scale Scripts: Attackers scan for open database ports, drop templated ransom notes (e.g., read_me_to_recover, btc_ransom_note), and move on. Payment is optional; the damage is not. - Disposable Infrastructure: High-volume contact emails (e.g., [email protected]) pair with the same wallets across thousands of attacks, suggesting a small group of operators reusing tools. - Global Distribution: The most affected countries China (11,874), U.S. (4,194), Germany (2,026) reflect cloud-hosting density rather than targeted negligence. ### The Bigger Picture Database extortion remains an overlooked corner of ransomware, lacking the branding of high-profile groups. Yet, its impact is severe: exposed databases are compromised within hours, and even when ransoms go unpaid, the data loss is irreversible. The economics are brutal $25 per ransom-marked database but the operational harm is vast. The lesson for defenders is clear: unsecured databases are not at risk they are already compromised.