MongoDB Security Incident Update, December 20, 2023

MongoDB
December 21, 2023 | Updated: January 3, 2024

The following is an update on the security incident first reported on December 16, 2023, US Eastern time (EST). For all critical alerts and advisories for MongoDB, please visit mongodb.com/alerts.

We continue to find no evidence of unauthorized access to MongoDB Atlas clusters or the Atlas cluster authentication system.

Based on the investigation to date, the unauthorized third party used a phishing attack to gain access to some of the corporate applications that we use to provide support services to MongoDB customers. In collaboration with outside forensic experts, we currently have a high level of confidence that the unauthorized third party has been removed from our corporate applications and that this incident is contained.

Although our investigation remains ongoing, today we’re sharing additional information regarding the contact information and related account metadata that we have identified as having been exposed. The tables below show the relevant fields.


CRM Application

Field Name Description
Salutation
First Name
Last Name
Title
Account Name Company Name
Address Street
Address City
Address State
Address Zip
Address Country
Phone 1 Primary Phone
Phone 2 Mobile
Phone 3 Fax
E-Mail
Owner Full Name MongoDB Sales Contact

Customer Support Application

Field Type Description
User Name String Username / email address for account.mongodb.com
Last Auth Date/Time Time of last user authentication
Last Auth Method String Last authentication method used
Time Zone ID String ID for user's preferred time zone
Time Zone Code String Alphabetical code for user's preferred timezone
Created Date/Time User registration time
First Name String User first name
Last Name String User last name
User ID String Internal unique user identifier
Is Invite Boolean User invited but has not yet accepted invite
Read Only Boolean User has limited permissions
Last Page View Date/Time Last time a page was viewed by user
Login Count Number Number of times a user has logged in
Is Locked Boolean Indicates if user is locked, automatically or manually
Is Deleted Boolean Indicates if user has been deleted
Deleted Date Date/Time Time at which the user was deleted
Email Last Verified Date/Time Email verification date
Email Needs Verification Boolean Email needs verification
Email Address String Alternate email address
Has Account Multifactor Auth Boolean User is enrolled for multifactor authentication
Deprecated Fields The fields below are only populated for users of our deprecated multifactor authentication (MFA) system. We released our current MFA system in January 2021.
Multifactor Auth Phone String Phone number used for deprecated MFA
Multifactor Auth Extension String Phone number extension used for deprecated MFA
Multifactor Auth Backup Phone String Alternate phone number used for deprecated MFA
Multifactor Auth Backup Phone Extension String Alternate phone number extension used for deprecated MFA
Multifactor Auth Authenticator Boolean Specifies whether an authenticator device was used for deprecated MFA
Multifactor Auth Voice Boolean Specifies whether a user of deprecated MFA wished to receive voice calls
Unused Fields The following fields are no longer in use by any system.
Multifactor Auth Update Key String May be populated for users of deprecated MFA. Field is not used by any system.
Team IDs String[] Empty and unused
Num Teams Number Empty and unused
Status String Empty and unused
Num Groups Number Empty and unused
Internal Fields
Roles String[] Internal field, populated only for MongoDB employee records
Roles String String Internal field, populated only for MongoDB employee records

In addition, we previously disclosed a list of indicators of compromise (IOCs) from which we detected unauthorized activity; that list is shared again below. Pursuant to industry best practices, we recommend that customers take the following actions using this information:

  • Provide this list of IOCs to your security or infrastructure teams. These teams can proactively set up firewall blocks or monitoring, as appropriate.

  • Search your application or infrastructure logs for these addresses to identify possible anomalous activity.

  • Please be aware that threat actors will regularly change IP addresses, therefore this list is not exhaustive.


Indicators of Compromise (IOC)

107.150.22.47
138.199.6.199
146.70.187.157
179.43.189.85
185.156.46.165
198.44.136.69
198.44.136.71
198.44.140.133
198.44.140.199
199.116.118.207
206.217.205.88
66.63.167.152
66.63.167.154
87.249.134.10
96.44.191.132

We also continue to recommend that customers be vigilant for social engineering and phishing attacks, activate phishing-resistant, multifactor authentication (MFA), and regularly rotate their passwords. To learn how you can enable phishing-resistant MFA on MongoDB’s native cloud authentication service, read our documentation on managing MFA options. MongoDB Cloud also supports federating your identity from your IDP, and you can read about configuring federated authentication here.

Moving forward, MongoDB will post updates to mongodb.com/alerts when we have notable new information.

Update as of January 3, 2024: The investigation of this incident is complete and closed. Please see the MongoDB Alerts page for more information.

← Previous

Two Keys To AI’s Future: What We Heard From Developers At AWS re:Invent 2023

At AWS re:Invent 2023, we chatted with numerous developers about the thing everyone was talking about. Which was… drum roll AI. Specifically, Generative AI. So much has happened over the last year in this space. LLMs have gone from being primarily a field of academic research to something every developer, product engineer, IT decision maker, C-level executive (and everyone in between) is thinking about. Questions that have emerged in that time—in the news, at tech conferences, in conversations with developers, among colleagues, in blog articles, etc.—include: Are we in a hype cycle? Is this just another fad? Is AI, after a series of promising starts and then long winters, here to stay for real this time? And if so, how can an organization use Generative AI to disrupt the market instead of being disrupted? We chatted with several developers at AWS re:Invent to get a sense of what they were thinking about when it comes to Generative AI. Here’s some of what they had to say: "[Generative AI] will help people build faster and safer, but [it’s] definitely not going to replace everything." - Developer "I'm excited about all the tools that can help developers to develop faster, like CodeWhisperer." - Head of Cloud Operations "Generative AI is here to stay." - Chief Technology Officer The theme throughout these quotes is how Generative AI will benefit developers in the work they do. Specifically, how Generative AI will help them develop faster and easier. A prime example of this is, as one of those quotes above notes, Amazon CodeWhisperer, which boosts developer productivity through AI-driven code assistance. The data used to train Generative AI code assistants, like Amazon CodeWhisperer, is key, though. This is why MongoDB collaborated with the Amazon CodeWhisperer Data Science team to train CodeWhisperer’s foundational model on MongoDB use cases to give developers the best possible code suggestions. In addition to helping developers do their work faster and easier, advancements in Generative AI are also empowering developers—specifically developers with more limited backgrounds in AI/ML—to use LLMs more effectively in their applications. In fact, it’s now easier than ever for developers to build AI-powered apps. As one data engineer at AWS re:Invent 2023 said: “Generative AI enables people that have no experience in AI to start entering this industry to use their domain knowledge to explore the applications.” A good example of this is Retrieval-Augmentation Generation or RAG. MongoDB’s Mat Keep writes in a recent blog article : “As recently as 12 months ago, any mention of retrieval-augmented generation (RAG) would have left most of us confused. However, with the explosion of generative AI, the RAG architectural pattern has now firmly established itself in the enterprise landscape.” RAG presents developers with a potent combination. They can take the incredible knowledge and reasoning capabilities of pre-trained, general purpose Generative AI models and feed them with accurate and up-to-date company-specific data. This means developers can build AI-powered apps that generate outputs grounded in enterprise data and knowledge without having to turn to specialized data science teams to train or fine-tune models — which is a complex, time-consuming, and expensive process. RAG is one of many examples of how development tools and technologies are changing to allow developers to build AI confidently and securely. When you look at all of the above, it’s very clear that this new revolutionary era of Generative AI is driven by empowered developers. Still, because there are so many incredible advances in both commercial and open-source Generative AI models, and because everyone has access to these, the real differentiation comes down to something unique to every organization: data. One question we’re left to ask is: What will developers be talking about with respect to Generative AI at AWS re:Invent in the coming year? As we’ve seen over the last twelve months, a lot can happen and change. So there’s no exact telling what the future will hold. But what is clear is that the two key things that will determine Generative AI’s future will continue to be data and developers. To learn more, check out our resources page for building AI-powered apps .

December 19, 2023
Next →

Building AI With MongoDB: Integrating Vector Search And Cohere to Build Frontier Enterprise Apps

Cohere is the leading enterprise AI platform, building large language models (LLMs) which help businesses unlock the potential of their data. Operating at the frontier of AI, Cohere’s models provide a more intuitive way for users to retrieve, summarize, and generate complex information. Cohere offers both text generation and embedding models to its customers. Enterprises running mission-critical AI workloads select Cohere because its models offer the best performance-cost tradeoff and can be deployed in production at scale. Cohere’s platform is cloud-agnostic. Their models are accessible through their own API as well as popular cloud managed services, and can be deployed on a virtual private cloud (VPC) or even on-prem to meet companies where their data is, offering the highest levels of flexibility and control. Cohere’s leading Embed 3 and Rerank 3 models can be used with MongoDB Atlas Vector Search to convert MongoDB data to vectors and build a state-of-the-art semantic search system. Search results also can be passed to Cohere’s Command R family of models for retrieval augmented generation (RAG) with citations. Check out our AI resource page to learn more about building AI-powered apps with MongoDB. A new approach to vector embeddings It is in the realm of embedding where Cohere has made a host of recent advances. Described as “AI for language understanding,” Embed is Cohere’s leading text representation language model. Cohere offers both English and multilingual embedding models, and gives users the ability to specify the type of data they are computing an embedding for (e.g., search document, search query). The result is embeddings that improve the accuracy of search results for traditional enterprise search or retrieval-augmented generation. One challenge developers faced using Embed was that documents had to be passed one by one to the model endpoint, limiting throughput when dealing with larger data sets. To address that challenge and improve developer experience, Cohere has recently announced its new Embed Jobs endpoint . Now entire data sets can be passed in one operation to the model, and embedded outputs can be more easily ingested back into your storage systems. Additionally, with only a few lines of code, Rerank 3 can be added at the final stage of search systems to improve accuracy. It also works across 100+ languages and offers uniquely high accuracy on complex data such as JSON, code, and tabular structure. This is particularly useful for developers who rely on legacy dense retrieval systems. Demonstrating how developers can exploit this new endpoint, we have published the How to use Cohere embeddings and rerank modules with MongoDB Atlas tutorial . Readers will learn how to store, index, and search the embeddings from Cohere. They will also learn how to use the Cohere Rerank model to provide a powerful semantic boost to the quality of keyword and vector search results. Figure 1: Illustrating the embedding generation and search workflow shown in the tutorial Why MongoDB Atlas and Cohere? MongoDB Atlas provides a proven OLTP database handling high read and write throughput backed by transactional guarantees. Pairing these capabilities with Cohere’s batch embeddings is massively valuable to developers building sophisticated gen AI apps. Developers can be confident that Atlas Vector Search will handle high scale vector ingestion, making embeddings immediately available for accurate and reliable semantic search and RAG. Increasing the speed of experimentation, developers and data scientists can configure separate vector search indexes side by side to compare the performance of different parameters used in the creation of vector embeddings. In addition to batch embeddings, Atlas Triggers can also be used to embed new or updated source content in real time, as illustrated in the Cohere workflow shown in Figure 2. Figure 2: MongoDB Atlas Vector Search supports Cohere’s batch and real time workflows. (Image courtesy of Cohere) Supporting both batch and real-time embeddings from Cohere makes MongoDB Atlas well suited to highly dynamic gen AI-powered apps that need to be grounded in live, operational data. Developers can use MongoDB’s expressive query API to pre-filter query predicates against metadata, making it much faster to access and retrieve the more relevant vector embeddings. The unification and synchronization of source application data, metadata, and vector embeddings in a single platform, accessed by a single API, makes building gen AI apps faster, with lower cost and complexity. Those apps can be layered on top of the secure, resilient, and mature MongoDB Atlas developer data platform that is used today by over 45,000 customers spanning startups to enterprises and governments handling mission-critical workloads. What's next? To start your journey into gen AI and Atlas Vector Search, review our 10-minute Learning Byte . In the video, you’ll learn about use cases, benefits, and how to get started using Atlas Vector Search.

April 25, 2024