Unprotected MongoDB Leak Exposes 845,000 MDPI Author and Reviewer Records
What Happened – In August 2016 MDPI left a MongoDB database exposed to the Internet. The 17.5 GB dump contained email exchanges, IP addresses, names and 845,012 unique email addresses of authors and reviewers. MDPI later secured the instance and judged the data non‑sensitive, so no public notification was issued.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of mis‑configured data stores – a control‑assurance program must continuously verify secure configuration and access restrictions.
- Provides a concrete example of why audit‑ready evidence of remediation (e.g., configuration change logs) is essential for defensible compliance reporting.
- Highlights the need for a centralized Trust Center that maps configuration controls to multiple frameworks and supplies ongoing monitoring data.
Who Is Affected – Scholarly publishing (open‑access journals), research institutions, and any organization that stores author/reviewer communications.
Recommended Actions
- Conduct an inventory of all database and storage assets and verify they are behind authenticated firewalls.
- Apply least‑privilege network and database access controls; enable encryption at rest and in transit.
- Activate detailed logging and integrate the logs into a continuous monitoring solution.
- Document the remediation steps in a Trust Center to create audit‑ready evidence for future assessments.
Technical Notes – Attack vector: misconfiguration (unprotected MongoDB). Data types exposed: email addresses, names, IP addresses, email message content. Source: Have I Been Pwned – MDPI breach