TiDB leaks expose PingCAP pasting customer AWS credentials into Jira tickets

JosephJacks_ · x · 2026-10-21

A leaked dump dubbed 'TiDB leaks' reveals PingCAP's support operation as a cross-tenant disclosure engine: engineers paste customers' production credentials directly into Jira tickets, with the dump including full customer credential logs (02customercredentiallogs) and the tickets themselves (05jiraissues). Ticket GTOC-5812 (2023-02-01) contains live AWS access and secret keys plus a command listing a customer S3 bucket; another attachment, APID-11182, is a full TiDB log. The poster urges switching from Atlassian to Plane, arguing Atlassian is 'completely fucked' over the incident.

Related event: PingCAP Confirms Unauthorized Access as 'TiDB Leaks' Report Alleges Security Failures(4 posts)→

Original post →

More from Companies & People

Companies & People channel →