The database is not immediately accessed directly, but threat actors learn enough about a system to work out what they want to know. Blind SQL injections are also known as inferential SQL injections, ...

It's not so much a black and white, SQL vs. NoSQL situation, of course: TokBox still kept SQL databases around. That's where his team fed portions of Hadoop output for analysts to query more easily.