PingCap TiDB Leaks
PingCAP's TiDB Cloud has suffered a cataclysmic data leak, with an attacker exfiltrating 10.6 TB of customer data, internal documents, and source code, including plaintext API keys and customer SQL. This incident exposes profound security negligence in a managed database provider, revealing their own team's warnings were ignored for years. It serves as a chilling testament to the "trust us with your data" perils and the potential for devastating multi-tenant compromise.
The Lowdown
FulcrumSec has publicly disclosed an unprecedented 10.6 TB data leak from PingCAP's TiDB Cloud, a managed database service. The exfiltration, which went undetected for months, compromised virtually every aspect of PingCAP's operations and its customers' sensitive data, exposing critical vulnerabilities in cloud security and corporate diligence.
- Massive Exfiltration: Over 10.6 TB of data, including 4.9 million files, was systematically exfiltrated, encompassing the complete TiDB Cloud control plane, billing, finance, GCP storage, AWS cost data, Jira, CRM, analytics, and source code.
- Sensitive Customer Data Compromised: The breach exposed 180,046 tenant organizations, 403,262 unique emails, 115,308 plaintext customer API keys (42,612 active), 20.6 million customer SQL statements (including sensitive schemas and data), and customer server IPs.
- Internal Negligence Exposed: PingCAP reportedly had "zero visibility" into its cloud services, failing to detect mass exfiltration over two months, including a continuous six-hourly replication feed of their control-plane database.
- Ignored Warnings: Internal Jira tickets from 2022 (SECURITY-22) explicitly warned that any organizational role could unconditionally reset root passwords for customer clusters, posing "great security risk," yet the vulnerability remained unaddressed.
- Poor Credential Handling: PingCAP engineers routinely pasted customer production credentials (AWS keys, GitHub tokens, AI platform API keys, database connection strings) directly into Jira tickets, making them accessible to attackers.
- Deep Financial and Identity Data: The leak included detailed AWS cost data attributed per tenant, sales contracts (e.g., $74.7M Wetech, $45.2M PayPay), and identity graphs cross-referencing user IDs, emails, employer tenant IDs, and even developer intelligence from
reo.devwith buying propensity rankings for major tech companies. - Public Release: FulcrumSec released an initial 128.3 GB of compressed data (over 200 GB uncompressed) via BitTorrent, with more promised.
This incident serves as a stark warning to all multi-tenant cloud providers about the critical importance of robust security practices, internal visibility, and heeding internal warnings. For customers, it underscores the need for extreme vetting of cloud service providers and understanding the profound risks associated with entrusting critical data and infrastructure to third parties.
The Gossip
Colossal Compromise & Cloud Catastrophe
Commenters are aghast at the "entire leak of ALL" PingCAP's customer data and internal assets, contextualizing it against a backdrop of other recent major tech incidents. The sheer scale and depth of the breach, including customer SQL and API keys, evokes widespread alarm and disbelief, prompting questions about why such a monumental event isn't dominating tech discussions.
Financial Follies & AWS Figures
The detailed financial data within the leak sparks discussion, particularly PingCAP's substantial AWS private rate discounts (around 47% off list price). Commenters note the significant portion of their bill dedicated to cross-AZ traffic, highlighting the often-overlooked costs and opaque pricing structures of cloud infrastructure.