Hackers break into databases, steal their content, hold it for ransom for 9 days, and then sell to the highest bidder if the DB owner doesn't want to pay the ransom demand.
Guardicore Labs uncovers an opportunistic Ransomware campaign which targets internet-facing MySQL servers. The attackers use Double Extortion, and publish the data to pressure victims into paying the ransom.