As it says in the first line of the article, this looks very much like what happened with MongoDB recently including (I suspect) that the data has just been deleted and replaced rather than copied/backed up by the black hats.