I understand it needs to be low enough to make payment an "attractive" option (at least compared to other means of recovery, if any...). But 200 USD is significantly less than the 500 USD ransom extorted from private PC users.
Should we conclude the extortionists expect the database content to be worth less to a company owning it than a private person is willing to pay for his/her pictures, music files and documents?
Many of these could be caches, or rebuildable from other sources.
Many could be disposable.
Since you can't really know which database is valuable and which not, you sort of average the price, since this is volume game.
Or maybe he want's to give the impression that this is not very profitable, to keep others from doing the same.
I guess the high risk of getting nothing in return is affecting the pricing.
- A/B testing of ransom prices will happen
- the person paying the ransom is not the company but an employee afraid for their job
- companies more likely to be able to restore from backup
(Ask since I'm used to running valid A/B test on groups in the 1000s.)
(Ask since to me it reads as gibberish and there's no way to Google it myself.)
The "tough love" approach to raising awareness about security.
What I mean is, it's pretty ignorant that just because authentication isn't on by default you don't turn it on at all.
Even if you don't want to or don't think to configure mongodb itself setting up a firewall also seems to be common sense.
Thus, the only reason they'd be unsecured is they're either for random tests or hobby.