NewsBlur

NewsBlur provides an RSS reader service that enables users to subscribe to and read news feeds from various sources.
The company's headquarters is located in the United States of America.
It is described as a popular RSS reader service within its market.

On June 24, 2021, a hacker compromised and wiped the database of NewsBlur.
The breach was traced to a firewall misconfiguration that occurred during a database migration process.
Docker overrode the existing firewall rules as part of this migration activity.
This action exposed the MongoDB servers to the public internet.
The attacker subsequently demanded a ransom payment in exchange for restoring the data.
NewsBlur was able to resume normal operations by restoring the database from a recent backup taken during the migration.

The incident exemplifies a broader pattern of automated attacks that target internet-exposed MongoDB instances.
Threat actors frequently scan for and exploit unprotected databases to extort payments from affected organizations.
In many of these cases, the attackers do not actually possess copies of the data before issuing their demands.
The compromise occurred shortly after the firewall misconfiguration was introduced.
The attacker identified the vulnerable server within approximately three hours of it becoming exposed.
The incident was reported by The Record media outlet.