PingCAP confirms theft of source code and customer data

PingCAP confirmed that an intruder reached its internal systems and took source code along with customer-related records, according to InfoQ. FulcrumSec, the group behind the extortion demand, says it exfiltrated 10.6 TB of material, including 413 private code repositories, TiDB Cloud control-plane data, SQL text, API keys, connection and billing logs, and internal documents. Those figures have not been independently verified.

FulcrumSec stated it possessed the entire TiDB Cloud control plane and a record of every customer connection over a four-year period, and that its access went unnoticed for many weeks. The group said some of the exposed credentials could allow attackers to reach customer environments.

PingCAP said a third-party incident response provider examined its production systems and saw no indication that the attacker ran commands or maintained persistent access. The company said that finding does not reduce the data exposure it described, and that there is no evidence data stored in TiDB was affected. According to PingCAP, the exported records contained names, email addresses, organization and project links, SQL editor text, and error messages, with some records also including organization, project, and cluster identifiers.

The attacker, according to FulcrumSec, obtained the full metadb database, which held roughly 180,000 tenant organizations, nearly 300,000 user records with 166,000 real names, and more than 400,000 unique email addresses. The group also says it has 115,000 console API keypairs, over 40,000 of which are active, and about 1,800 external database endpoints linked to customer migration jobs, including root and admin credentials for MySQL and Aurora hosts. These claims have not been independently verified. PingCAP's customer advisory page tells users to rotate active TiDB Cloud management API keys and watch for targeted phishing attempts.

Kim Barthel, director and founder of 42Sec, said the incident is less a database story than a story about one service-account key. The exposed data, Barthel said, includes engineer names, payment information, contract renewal dates, and schema details, "everything needed for a phishing email you'd actually believe."

On Hacker News, InfoQ reported, practitioners questioned PingCAP's response. User dherls wrote: "If true, this is next level incompetence from PingCap. Apparently the attackers set up a replication pipeline for a month?!" Another user, xKingfisher, pointed out that the breach came after TiDB opened its source code for an independent security review by NCC Group.

InfoQ wrote that records allegedly reference companies such as Baidu, SoftBank, Fujitsu, Atlassian, Databricks, Pinterest, Airbnb, Shopee, and Booking.com, but the presence of those names does not prove those businesses were compromised. Bitget, a crypto exchange named in the report, said it found no sign that its users' data was exposed. The first FulcrumSec release contains five tar.gz files that compress to 128.3 GB and expand to just over 200 GB out of the claimed 10.6 TB total.