This was 100% preventable, MongoDB comes with great resources for securing your data. I pity whomever puts ANY database on the internet without taking proper security measures.

Here's some documentation to get you started.

https://www.mongodb.com/blog/post/how-to-avoid-a-malicious-a...

https://docs.mongodb.com/manual/administration/security-chec...

https://www.mongodb.com/collateral/mongodb-security-architec...

This really should have been titled "the importance of good DBA's..."