The exfiltration logs reveal 88 six‑hourly exports that went undetected for weeks.
PINGCAP TIDB CLOUD DATA BREACH EXPOSES 10.6 TB OF CUSTOMER INFO
*PingCAP’s TiDB Cloud suffered a massive, undetected exfiltration of over 10 TB of data. The leak includes tenant records, plaintext API keys, billions of gateway connections and detailed financials. The breach shatters the company’s core claim of secure multi‑tenant hosting.*
PingCAP announced today that its TiDB Cloud service suffered a massive data breach, leaking 10.6 TB of customer information. The leak spans the entire production control plane, including tenant organisations, user records, API keys and raw SQL statements. Over a two‑month window, attackers exported data every six hours, never triggering an alert. The breach undermines PingCAP’s promise of secure, shared‑infrastructure hosting for banks, game studios and e‑commerce platforms. It also reveals deep operational blind spots that allowed the exfiltration to continue unchecked.
How extensive was the TiDB Cloud exfiltration?
The attackers siphoned 10.6 TB of data across 88 consecutive six‑hourly exports from 8 September to 30 September. They accessed roughly 50 GCP storage buckets, a 533.8‑million‑row BigQuery warehouse and over 4.9 million files. The pipeline, built on credentials left in PingCAP’s own repos, reproduced the entire control‑plane database every six hours without triggering any alert. The final export ran at 06:02 UTC on 30 September, delivering a complete snapshot of 180,046 tenant organisations, 403,262 unique emails and 115,308 plaintext API keys, of which 42,612 were still active.
What data did the attackers obtain?
The breach exposed the full control plane: 292,276 user records (166,108 real names), 388,861 projects, 3.45 million serverless clusters and 16,299 dedicated clusters. It also captured 20,645,574 raw SQL statements, revealing schemas such as a medical‑professional table and a Brazilian clinic’s patient roster. Gateway logs recorded 102,003,766 connections and 5,036,738 server IPs. Financial data included 57 months of AWS spend totaling $107,195,238.42, detailed discount structures and per‑tenant billing rows. CRM and marketing systems revealed 433,928 contacts, $552 million in deals and 8,428 paying tenants linked to Stripe accounts.
Why did PingCAP fail to detect the breach?
PingCAP’s internal monitoring missed every one of the 88 exports. The company relied on expensive EDR tools while neglecting basic cloud‑asset hygiene, leaving half a thousand S3‑style buckets exposed. Their billing engine trusted unverified X‑ACCOUNT‑USER‑ID headers, and the account service allowed admin impersonation via a tenant ID, bypassing org checks. Cryptographic practices were weak: the shared crypto library used AES‑CBC with a static IV and a single server‑wide SaltSecret, rendering encrypted passwords effectively plaintext. These systemic flaws created a blind spot that let the attackers operate for nearly two months.
What are the potential repercussions for customers?
Customers now face exposure of proprietary business logic, patient data, and financial records. Active API keys (42,612) can be used to spin up new clusters or extract further data. The detailed gateway logs provide a roadmap for targeting specific tenant IPs and applications. Financial disclosures could invite regulatory scrutiny and legal action, especially for banks and healthcare providers. The breach also undermines confidence in multi‑tenant cloud databases, likely prompting migrations to self‑hosted solutions or competitors with stronger security postures.
Frequently asked questions
How much data was exfiltrated from TiDB Cloud?
The attackers stole a total of 10.6 TB of data, spread across 4,901,203 files and 88 consecutive six‑hourly exports.
What types of customer information were exposed?
Exposed data includes 180,046 tenant organisations, 403,262 unique emails, 115,308 plaintext API keys, 20,645,574 SQL statements, gateway logs with over 102 million connections and detailed AWS billing totaling $107 million.
Why did PingCAP not detect the breach?
PingCAP lacked visibility into its cloud assets, relied on unverified headers, stored passwords in plaintext, and used weak encryption with a static IV, allowing the exfiltration to proceed unnoticed.
The TiDB Cloud breach is a stark reminder that multi‑tenant platforms must prioritize visibility and robust credential hygiene over flashy security tools. With plaintext API keys, weak encryption and unchecked service‑account keys, PingCAP left a treasure trove for attackers. Customers must audit their own exposure, rotate credentials and consider moving critical workloads away from vulnerable shared services. The industry will watch closely as regulators and partners demand accountability.
Sources: Hacker News (PingCap TiDB Leaks) https://fulcrumsec.vg/pingcap/