Hey It is a virus attack read this article https://www.bleepingcomputer.com/news/security/mongodb-apocalypse-professional-ransomware-group-gets-involved-infections-reach-28k-servers/

Actually more then 28k mongodb server have been attacked by the community and they have either deleted the database or have encrypted them. Now they are demanding Bit coin for giving backup.

Now the Question arises that is mongoDb safe as so many database have been deleted or encrypted

Answer is YES Mongodb is completely safe the reason behind this was the lack of security measures used by the programmers.

1. You should only open the port of the server that are required example in Amazone web server (AWS) some programmers Open all the ports of security groups stop doing that.

Now come to the solution of the problem.

Do check mongod.conf file on the server:

When we install mongodb a file name mongod.conf is automatically generated on the server. you can check it by following command.

cd /etc/
sudo vim mongod.conf

in this image you will find bindIp is 127.0.0.1 which is a localhost means only this server is allowed to use the database in your case this must be 0.0.0.0 which allow the hackers to get access to your data and delete all the files so just update the bindIp to 127.0.0.1 and it wont happen as of now.

Even you can use mongo Authentication use this link for further reference https://docs.mongodb.com/manual/tutorial/enable-authentication/

I have noticed a behavior:

Create new Database > do not add ANY data (collections / documents) yet > disconnect your mongodb client > re-connect to mongodb > boom, the new database disappears!

And when there is some data added, it obviously doesn't auto remove the database.

I guess this is default behavior of mongodb, or may be the client i use (Robo 3T).