PingCAP's TiDB Cloud breach exposes 10.6 TB of customer data, including plaintext API keys and SQL statements
PingCap TiDB Leaks
A hacker group claims to have exfiltrated 10.6 TB from PingCAP's TiDB Cloud over two months, including the production control plane, 115,308 plaintext API keys, 20.6 million customer SQL statements, and 413 source repositories. The attackers say they used credentials committed in PingCAP's own repos to replicate the control-plane database every six hours for 22 days without detection. The release also includes Jira tickets where engineers pasted live customer credentials, and an internal 2022 security ticket warning that any org member could reset cluster root passwords.
Four years before we walked in, their own security team had documented that any member of a customer organisation — including a billing-only role — could take over every cluster in that organisation as root.
- nemothekid
Man I recently executed a migration from Aurora to Planetscale. I seriously considered PingCap but decided against it because I thought they cloud pricing was too complex. I wonder if my personal information is in the leak.
- dherls
If true, this is next level incompetence from PingCap. Apparently the attackers set up a replication pipeline for a month?!
> We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out.
- arpinum
AWS private rates gives PingCAP ~47% off list price. Wonder which services got the biggest discounts? Unsurprisingly for a db company the cross-az traffic is 15% of their bill.