PingCAP Confirms Data Breach Involving Customer Records and Source Code Theft

PingCAP has confirmed unauthorized access to its internal systems, leading to the theft of source code and customer-related data. The cyber extortion group FulcrumSec claims to have stolen 10.6 TB of data, which includes TiDB Cloud control-plane records, customer SQL statements, API keys, connection logs, billing information, internal documents, and 413 private source-code repositories.

FulcrumSec alleges that the breach went undetected for several weeks and that some exposed credentials could allow access to customer systems. They stated, “We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers.”

PingCAP, the company behind TiDB, an open-source distributed SQL database compatible with MySQL, reported that an external incident response firm reviewed its production systems and found no evidence that the attacker executed commands or maintained persistent access. However, this finding does not negate the data exposure described in their report.

The company confirmed that the exported records included user names and email addresses, organization and project associations, and SQL editor text and errors. Some records also contained organization, project, and cluster identifiers.

According to FulcrumSec, they obtained a complete copy of metadb, which includes around 180,000 tenant organizations and nearly 300,000 user records, including 166,000 real names and over 400,000 unique email addresses. The data allegedly contains 115,000 console API key pairs, with over 40,000 being active at the time of the breach, and the newest reportedly created just hours before the attacker claims to have ended access.

Additionally, the group claims to have acquired around 1,800 external database endpoints from customer migration jobs, including root and admin accounts for customer MySQL and Aurora hosts. FulcrumSec also alleges that PingCAP engineers have pasted customers’ production credentials into Jira tickets, providing logs that were reproduced in full along with the corresponding tickets in their initial release.

Kim Barthel, director and founder of 42Sec, cautioned that the breach is not merely a database issue but highlights the risks associated with service-account keys. He noted, “PingCAP says it has no evidence that customer data stored in TiDB itself was touched. Good. But look at what did leak. Whoever has it knows who your engineers are, what you pay, when your contract renews, and what your schema looks like. That’s everything needed for a phishing email you’d actually believe.”

This incident underscores the potential for cloud providers to inadvertently store sensitive customer data in query histories, support tickets, and diagnostic logs.

Source: InfoQ