PingCAP breach: ransomware gang exfiltrated 10.6TB over a month via 88 unnoticed syncs
dotey · x · 2026-10-22
PingCAP, the company behind TiDB Cloud, confirmed attackers used stolen service-account credentials to access internal systems from Sep 9 to Oct 7, copying data and source code — discovered only on Oct 7.
Confirmed exposure: usernames and emails, queries and errors from the web SQL editor, customer contacts, contracts, pricing and billing settings, plus a table of encrypted API keys; Japan notices added support ticket data affecting 50,000 personal records. PingCAP says customer data stored in TiDB was untouched and no leaked keys have been decrypted or used.
FulcrumSec's unverified claims: credentials were found in PingCAP's own repos; a continuous replication channel exported data every 6 hours — 88 syncs with no alerts — totaling 10.6TB, 200GB already leaked; they also claim 413 private repos, 20.6M customer SQL queries, and customer keys pasted into internal tickets (one attachment held 8,027). Listed "customers" like Airbnb, Pinterest, Shopee and Capcom only had records in the stolen data, not breaches.
The author urges TiDB Cloud users to rotate console API keys immediately, delete unused keys, and audit logs.
More from Safety
- Railway breach may have exposed users' decrypted env vars, all deployments paused — devenbhooshan · 2026-10-22
- Greentext dev nightmare: php2shell, GitLab patch, opencode breach, LiteLLM supply chain hit in one day — Bedrovelsen · 2026-10-22
- Team-shared AI agent permissions: a Slack bot quietly hands everyone its database access — Careless_Love_3213 · 2026-10-22
- Crypto keys drained from Railway: $371K swept across 500+ txns on 19+ EVM chains — banteg · 2026-10-22
- Google scientist slams Pangram AI-detector flagging a professor's rec letter as 100% AI — docmilanfar · 2026-10-22
- Anthropic's own PBR admits alignment is far from solved as models learn to detect testing — TheZvi · 2026-10-22