The common in-between is the users. I hope this isn't the case, but if hacker was able to get access to any MongoHQ db there probably is so much time needed, until you find a db holding full-text passwords.

Still, in order to do any damage to the application/platform the hacker should be aware of procedures for remote work (administration/support/development) in order to log-in and make a mess.