Security Mongo Database in Azure Virtual Machine

I've a Node Web App with Mongo DB running in Azure Virtual Machine. The connection string is similar to user:pass@IP:27017/MyDatabase

Nowdays Mongo database was stolen by "request@firemail.cc" email with the next message: "Your DB is in safety and backed up (check logs). To restore send 0.1 BTC and email with your server ip or domain name. Each 24 hours we erase all data.

I've credentials as Environment Variable in Azure and I don't have code source in a public repository.

Any suggestions to make Mongo Database safer or other advices in Azure to be considered?

Thanks a Lot.

via Gianfranco Manrique Valentín