So many possibilities. You could have a weak password, they could have exploited a mongo vulnerability, most likely they hacked your VM which has a much larger attack surface.