MDPI Data Breach (2016): What Was Exposed & What To Do

In August 2016, the Swiss open-access publisher MDPI experienced a data incident in which 17.5 GB of material was obtained from an unprotected MongoDB instance. The material included email exchanges between the publisher and its authors and reviewers, encompassing 845,000 unique email addresses along with associated names, IP addresses, and message content. The incident was reported on 30 August 2016.

The event is notable because it involved a large volume of correspondence within the academic publishing process and because the data source was left accessible without authentication. MDPI stated that the database has since been secured and that the exposed material did not include data of a sensitive nature.

Inside the incident

The data originated from a MongoDB instance that was not protected by authentication controls at the time of the exposure. The contents consisted of email exchanges between MDPI staff and external authors and reviewers. The publisher confirmed that the instance has been protected since the incident and that no notification to subscribers was issued, citing the public availability of author and reviewer contact details on its website.

No further technical details on the duration of exposure or the method of discovery have been disclosed in public reporting. The total number of affected individuals is given as 845,000 unique email addresses.

How a breach like this happens

Incidents involving unprotected databases commonly occur when administrative interfaces or data stores are configured for internal use but remain reachable from the public internet without password or network restrictions. MongoDB instances have historically been involved in such exposures when default settings that disable authentication are left unchanged in production environments.

Once discovered through automated scanning, an unprotected database can be read in full without any interaction with the owning organisation’s other systems. Remediation typically involves enabling authentication, restricting network access, and applying encryption or logging controls.

MDPI and its sector

MDPI is a Swiss-based publisher of peer-reviewed open-access journals. Organisations of this type maintain records of individuals who submit manuscripts or serve as reviewers, including contact details and correspondence necessary to manage the editorial process.

Because scholarly publishing relies on direct communication with researchers worldwide, the sector routinely holds large volumes of email addresses and message content. A compromise of such records can therefore affect a broad academic population even when the material itself is not classified as highly sensitive.

The information in question

The exposed data types explicitly named are email addresses, email messages, IP addresses, and names. MDPI stated that the material did not include data of a sensitive nature.

Exact details of every field contained in the 17.5 GB dataset have not been published. Organisations in academic publishing typically store additional metadata such as submission identifiers or review comments, but it is unconfirmed whether such fields were present in this instance.

What's at stake

Individuals whose email addresses and associated messages were exposed face an increased likelihood of receiving unsolicited messages or targeted phishing attempts that reference their prior contact with the publisher. Because the addresses belong to researchers and reviewers, the information could also be used to craft messages that appear contextually relevant.

For the organisation, the incident highlights the consequences of leaving production data stores accessible without authentication. While MDPI assessed the material as non-sensitive, the volume of correspondence still required subsequent security measures to prevent further access.

What to do if you're exposed

Anyone who suspects their email address may have been included can begin by monitoring the account for unusual login attempts or unsolicited messages that reference MDPI or academic submissions. Enabling two-factor authentication on the email account and any linked services reduces the chance that exposed addresses can be used for account takeover.

Readers may also run a free exposure scan of their email address against known breach data to determine whether their information appears in public records of this or other incidents. Keeping software and database configurations updated and restricting remote access remain standard preventive steps for any organisation handling similar records.

AICompiled with AI assistance from public sources and published under our editorial standards.