PingCAP TiDB Cloud: 10.6 TB Data Breach Exposed

FulcrumSec has published details of what it calls a complete breach of PingCAP's TiDB Cloud control plane, alleging it exfiltrated 10.6 TB across roughly 4.9 million files without triggering a single detection event. The attackers claim to have run for nearly two months, exploiting GCP service-account keys and an Azure service principal that PingCAP had committed directly into its own source repositories. Using those credentials, FulcrumSec says it stood up a replication feed of PingCAP's production control-plane database, pulling a full export every six hours for 22 days—88 consecutive exports from September 8 to September 30, the last at 06:02 UTC. Taken data reportedly includes 115,308 console API keypairs stored in plaintext (42,612 still active at time of disclosure), 20.6 million raw customer SQL statements from TiDB's SQL Editor and Chat2Query features, over 5 million customer server IPs from gateway logs, 1,809 external database endpoints including root credentials on customer MySQL and Aurora hosts, 377,446 Jira issues, 433,928 CRM contacts, 413 private source repos, and 92 GB of tenant-tagged AWS cost data. FulcrumSec states the breach covered AWS, GCP, Atlassian/Jira, and Azure environments simultaneously. Among the SQL data, the researchers highlight a table schema for medical professionals and patient records from a Brazilian clinic—illustrating that PingCAP's own query-logging pipeline captured and exposed sensitive customer data. PingCAP has not yet issued a public statement.