PingCAP, the developer of the open-source distributed SQL database TiDB, recently confirmed that an attacker gained unauthorised access to its internal systems, resulting in the theft of source code and customer-related data. The cyber extortion group FulcrumSec has claimed responsibility, saying it obtained 10.6 TB of data, including 413 private source-code repositories, the TiDB Cloud control plane, billing information, internal documents, and a four-year log of every connection made by customers.
The attacker alleges that access continued undetected for many weeks and that some exposed credentials could provide access to customer systems. FulcrumSec said in a statement: "We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers."
In its incident report, PingCAP said: "An external incident response firm reviewed PingCAP's production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed. That finding does not change the data exposure described below." PingCAP added that there is no evidence that data stored in TiDB itself was impacted, but confirmed that exported records included user names and email addresses, organisation and project associations, and SQL editor text and errors. Some records also contained organisation, project, and cluster identifiers.
The attacker claims to have obtained a complete copy of metadb, containing around 180,000 tenant organisations, almost 300,000 user records including 166,000 real names, and over 400,000 unique email addresses. The data allegedly includes 115,000 console API keypairs, of which over 40,000 were active. The group also says it obtained around 1,800 external database endpoints from customer migration jobs, including root and admin accounts for customer MySQL and Aurora hosts. FulcrumSec alleges that PingCAP engineers paste customers' production credentials into Jira tickets, reproducing three logs in full and including the corresponding tickets in the initial release.
Kim Barthel, director and founder of 42Sec, said: "The PingCAP breach isn't really a database story. It's a story about one service-account key (...) PingCAP says it has no evidence that customer data stored in TiDB itself was touched. Good. But look at what did leak. Whoever has it knows who your engineers are, what you pay, when your contract renews, and what your schema looks like. That's everything needed for a phishing email you'd actually believe."
PingCAP has recommended that customers replace active TiDB Cloud management API keys and remain alert to targeted phishing attempts. On Hacker News, practitioners questioned PingCAP's response, with user dherls writing: "If true, this is next level incompetence from PingCap. Apparently the attackers set up a replication pipeline for a month?!" User xKingfisher noted the proximity of the breach to a recently announced security audit by NCC Group, calling it "pretty embarrassing for all parties."
The allegedly exposed records include data associated with companies such as Booking.com, Shopee, Airbnb, Pinterest, Databricks, Atlassian, Fujitsu, SoftBank, and Baidu, but this does not confirm that these organisations were compromised. For example, Bitget, one of the cryptocurrency exchanges mentioned in the report, said its investigation found no evidence that user data had been exposed.
FulcrumSec's first release consists of five tar.gz archives totalling 128.3 GB compressed and just over 200 GB uncompressed, out of a claimed 10.6 TB of data. The claims have not been independently verified.