I didn't have any important data in my db, but all of it was deleted. I would post the ransom message, but it keeps getting removed.

My server is just a DO Droplet. The only ports exposed are for ssh and nginx. Mongo is running in docker, with ports exposed locally but not through ufw. Plaintext passwords are also disabled through ssh. I can't find any good resources online to see what happened to my system, so any help would be appreciated.

EDIT: Just realized that docker networking services bypass ufw. I guess I'll either have to not expose a port, or add authentication to the db (karma on me for not doing that before).

EDIT 2: If anyone else runs into this issue, check out https://docs.docker.com/config/containers/container-networking/ You can expose docker to the localhost only.