🔒PingCAP Breach: 10.6TB of Data Stolen, Source Code and Customer Data Compromised
PingCAP Breach: 10.6TB of Data Stolen, Source Code and Customer Data Compromised
TL;DR
PingCAP confirms unauthorized access to internal systems, resulting in the theft of 10.6TB of data, including source code and customer-related information. This breach highlights the risks of storing sensitive data in cloud environments.
PingCAP has confirmed unauthorized access to its internal systems, resulting in the theft of 10.6TB of data, including source code and customer-related information. The attacker, FulcrumSec, claims to have stolen TiDB Cloud control-plane records, customer SQL statements, API keys, connection logs, billing information, and 413 private source-code repositories. This breach highlights the risks of storing sensitive customer data in cloud environments, such as query histories, support tickets, and diagnostic logs. PingCAP recommends that customers replace active TiDB Cloud management API keys and remain alert to targeted phishing attempts. The breach allegedly includes 115K console API keypairs, 180K tenant organizations, and over 400K unique email addresses.
Key Points
FulcrumSec claims to have stolen 10.6TB of data from PingCAP, including source code and customer-related information.
The breach includes 115K console API keypairs, of which over 40K were active at the time of the breach.
PingCAP's internal systems were compromised for weeks, with the attacker allegedly exporting control-plane data without detection.
The stolen data reportedly includes customer data from companies like Booking.com, Shopee, Airbnb, and more.
PingCAP recommends replacing active TiDB Cloud management API keys and being vigilant for phishing attempts.
Why It Matters
If you're using TiDB Cloud, this breach highlights the risks of storing sensitive data in cloud environments. PingCAP's incident report found no evidence of data stored in TiDB being impacted, but the exposure of customer API keys and internal documents could lead to targeted phishing attacks. Customers should replace active API keys and monitor for suspicious activity.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,567 builders reading daily.