A security researcher has disclosed a major breach of PingCAP's TiDB Cloud service, exposing 10.6 TB of data across 4,901,203 files and 180,046 tenant organizations. The exfiltration occurred over nearly two months, with 88 consecutive six-hourly exports of the production control plane going undetected from 8 September to 30 September. The compromised data includes 115,308 plaintext customer API keys (42,612 still active), 403,262 unique emails, 20,645,574 customer SQL statements, and 5,036,738 customer server IPs. The attacker also accessed 377,446 Jira issues, 433,928 CRM contacts, and 413 private source repositories. Using credentials found in PingCAP's own repositories, the attacker set up a replication feed that automatically re-exported the entire operational database every six hours. The breach exposed sensitive customer information including medical professional tables and patient rosters from a Brazilian clinic. PingCAP claims TiDB Cloud is secure for banks, game studios, and e-commerce platforms, but this incident demonstrates significant gaps in cloud service monitoring and detection capabilities. The company's entire business model relies on the safety of its shared, multi-tenant platform.
The control plane database (metadb) was replicated in full, containing 292,276 user records with 166,108 real names, 388,861 projects, 3,448,054 serverless clusters, and 16,299 dedicated clusters. Additionally, 1,809 external database endpoints were compromised, providing root and admin access to customer MySQL/Aurora hosts. The breach also exposed 290 customer AWS account IDs and 85 GCP project IDs from VPC peering records.
Gateway access logs revealed the complete installed base directory of the database company, showing every customer's connection volume, application server IP addresses, and client programs. This data provides a comprehensive targeting map for further attacks against TiDB Cloud customers.
The incident highlights the critical importance of proper cloud security configuration and monitoring, particularly for companies handling sensitive production workloads for enterprise customers.
Source: Hacker News · Summarized by HeadlinesBriefing