An attacker broke into database service MongoHQ and used an “impersonate” support feature to access a limited number of users’ data.