CircleCi's MongoDB was exposed for 10 days?

I didn't realize this until the email we got from Heroku a few minutes ago:

"Our records indicate that some of your apps (listed below) had been deployed during the the time period that CircleCI’s database was exposed (October 19 - 29th)."