[themerone]

So many possibilities. You could have a weak password, they could have exploited a mongo vulnerability, most likely they hacked your VM which has a much larger attack surface.

[NithurM]

What kind of mongo vulnerability? I am hosting it in AWS EC2. Is it possible to hack ec2 instance?