Check the GridFS to see if someone stored any files there. Check the logfiles to see who accessed the MongoDB (show log global command).

Also, Gevers urged users to check MongoDB accounts to see if somebody added a secret (admin) user, check the GridFS to see if someone stored any files there, and check the logfiles to see who accessed ...

A huge MongoDB database exposing 275,265,298 records of Indian citizens containing detailed personally identifiable information (PII) was left unprotected on the Internet for more than two weeks.