PingCAP Suffers Data Breach, Source Code and Customer Records Stolen

Unauthorized Access Confirmed

PingCAP, the company behind the open-source distributed SQL database TiDB, confirmed that its internal systems were accessed without authorization. This breach led to the theft of both source code and customer-related data. An external incident response firm reviewed PingCAP’s production systems and found no evidence of the attacker running commands or maintaining persistent access, though data exposure occurred.

FulcrumSec Claims Responsibility

The cyber extortion group FulcrumSec claimed responsibility for the attack, stating they stole 10.6 TB of data. This alleged data includes TiDB Cloud control-plane records, customer SQL statements, API keys, connection logs, billing information, internal documents, and 413 private source-code repositories. FulcrumSec also alleged that access continued undetected for many weeks.

Exposed Customer Data

PingCAP confirmed that exported records included user names, email addresses, organization and project associations, and SQL editor text and errors. Some records also contained organization, project, and cluster identifiers. FulcrumSec claims to have obtained a complete copy of a metadb with approximately 180,000 tenant organizations, nearly 300,000 user records (including 166,000 real names and over 400,000 unique email addresses), and 115,000 console API keypairs, with over 40,000 active.

Potential Credential Exposure

The attacker also claims to have obtained around 1,800 external database endpoints from customer migration jobs, including root and admin accounts for customer MySQL and Aurora hosts. FulcrumSec alleges that PingCAP engineers pasted customer production credentials into Jira tickets, providing specific examples to support this claim.