On Monday, a security researcher specialized in finding exposed databases has identified an unsecured MongoDB server that was leaking the personal details of nearly 11 million users.
More accurate title: "Unsecured MongoDB server contains 11M user records"
MongoDB has terrible security defaults but the software itself is not "leaking" anything, this instance has just not been properly configured.
Now I'm not saying MongoDB is blame free, they can certainly make it better, but the blame is at both the user and software.