Atlas: diagnose a spike in authentication failures

TL;DR: Auth failures jump in the logs. Work out whether it is a rotated credential, a stale deploy, or an actual attack probe. Confirm - Rotated password + one stale deploy = that deploy's failures. Fix Update the stale secret, or remove the stale deploy.

The error

text
authentication failure count jumps in Atlas logs or alerts.

The fix

TL;DR: Auth failures jump in the logs. Work out whether it is a rotated credential, a stale deploy, or an actual attack probe. Confirm - Rotated password + one stale deploy = that deploy's failures. Fix Update the stale secret, or remove the stale deploy.

The error

authentication failure count jumps in Atlas logs or alerts.

The fix

1. When did it start? Correlate with deploys, credential rotations, and IP access list changes.
2. Which usernames fail? One service user failing everywhere points at that service's stored secret. Many random usernames failing from one IP points at a scan/probe.
3. Which source IPs? Unexpected geographies or cloud ranges you do not use deserve a closer look.
4. Rotated password + one stale deploy = that deploy's failures. Check env vars and secret manager versions per service.
5. Deleted or renamed user + old string = same shape.
6. Random usernames = internet noise against the public endpoint; the IP access list should already be narrow, which makes this mostly harmless.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Atlas.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Authentication auditing and IP access list controls per https://www.mongodb.com/docs/atlas/troubleshoot-connection/ and https://www.mongodb.com/docs/atlas/security/ip-access-list/, verified 2026-09-26.