PingCAP discloses TiDB Cloud intrusion, urges API key rotation as FulcrumSec makes larger unverified claims

TLDR

• PingCAP says an intruder used stolen service account credentials to access internal systems from 9 September to 7 October.²
• PingCAP says billing data and encrypted API keys were exported, with no evidence of decryption or use.¹
• Extortion group FulcrumSec claims 10.6 TB and over 180,000 affected organisations; these claims are unverified.³

PingCAP, the company behind the TiDB database, disclosed on 19 October that its cloud resources had been accessed without authorisation.² Dark Reading, summarising PingCAP's security notification, reports that the intruder had access from 9 September to 7 October and used stolen service account credentials to reach internal systems and copy data and source code.² PingCAP's investigation, assisted by a third party, found no evidence of malicious commands, persistent access or access to customer databases, according to Dark Reading.² It says the data accessed instead included customers' billing and business data such as contract terms and pricing, plus cloud account and product usage details such as email addresses and SQL editor text and errors, and an exported table of encrypted API keys.²

In a follow-up dated 20 October, PingCAP told all customers to act without waiting for direct notification.¹ It said the API-key values in the breached data were encrypted and that it had found no evidence any were decrypted or used, but recommended organisation owners create replacement TiDB Cloud management API keys, update dependent applications and revoke the old keys.¹ Any key suspected of misuse should be revoked immediately, and PingCAP warned of targeted phishing because exported records included customer contacts and business and billing details.¹

FulcrumSec, an extortion group, claims far more.² Dark Reading says its leak-site post claims service management, financial, CRM and analytics records, source code and a four-year log of customer connections to TiDB Cloud, and that its access lasted nearly two months rather than one.² Crypto Briefing reports the group claims about 10.6 TB across 4.9 million files and that more than 180,000 organisations could be affected, and that as of 20 October none of this had been independently verified.³ Dark Reading did not confirm the claims either, though it notes the group's earlier claim over Manchester Airports Group data proved to understate rather than overstate what was taken.²

Bitget, one of the firms named by the group, said it had used TiDB Cloud only for public trade logs, stopped using it more than two months earlier and found no exposure of user data.³ Dark Reading quotes Sysdig's Crystal Morin saying customers often pass secrets to vendors for convenience, and argues that SQL history and support tickets may be the most acute exposure.²

Why it matters: even on PingCAP's narrower account, stolen billing records, SQL editor text and an encrypted key table give attackers phishing material and a possible route to secrets customers passed to the service, so TiDB Cloud customers should rotate management API keys now.¹²