PingCAP TiDB Cloud · Breach

PingCAP confirms internal breach; FulcrumSec alleges 10.6 TB theft

Sep 08, 2026 · 1 min read

PingCAP confirmed unauthorized access to internal systems between September 9 and October 7, 2026, via a compromised GitHub account and exposed cloud credentials; SQL editor history, contacts, and contract and billing records of TiDB Cloud customers were copied. NebuSec's investigation found no access to production customer databases, and all compromised credentials were invalidated by October 14. FulcrumSec claims it stole 10.6 TB; customers should rotate TiDB Cloud API keys and credentials shared with support.

By HIFY Radar newsroom Updated 10/26/2026 01:38 PM Get this every day →← Back to the feed 4 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

PingCAP confirmed that intruders accessed internal systems between September 9 and October 7, 2026 using a compromised GitHub account and exposed cloud credentials. The attackers copied TiDB Cloud customer data such as SQL editor history, contacts, and contract and billing records. The extortion group FulcrumSec claims it stole 10.6 TB and lists more than 180,000 affected organizations; Bitget, named on the list, says no user data was exposed.

Why it matters

The incident affects customers of TiDB Cloud, a managed database platform, but the independent investigation found no access to production customer databases. Sensitive business data, such as contract terms and billing, and credentials shared in support tickets were exposed, creating risk of follow-on access. PingCAP's Japanese notice reports leakage of up to about 50,000 personal data records.

What to do

Rotate TiDB Cloud management API keys now and any credentials shared with PingCAP support, review access logs and permissions, and warn staff about phishing that references the incident.

For the technical team

Affected: PingCAP TiDB Cloud (plataforma de banco de dados hospedada) · TiDB Cloud (customers); no product versions listed as affected. Per NebuSec, no access to production customer TiDB clusters.
Exploitation: Exploitation confirmed by PingCAP and NebuSec between September 9 and October 7, 2026. FulcrumSec claims theft of 10.6 TB across 4.9 million files, affecting more than 180,000 organizations, and published a sample of roughly 200 GB; claims unverified as of October 20.
Fix: No product patch. Critical credentials invalidated on October 7 and all identified ones by October 14; four vulnerabilities found in the source-code review were patched and retested by NebuSec, with no evidence of prior exploitation. Customers should rotate TiDB Cloud management API keys and any credentials shared with support.
Vector: Initial access via a compromised GitHub account exposing private repositories. The attacker harvested keys and tokens from repositories and Terraform state, then pivoted to Google Cloud, Jira, and an internal IM used for TiDB alerts. Through Jira support tickets, harvested credentials customers shared during support workflows, including AWS keys, reaching S3 buckets and the BigQuery data warehouse.
More details: NebuSec, engaged by PingCAP, led the investigation: no evidence of attacker command execution or persistence. TiDB Cloud API keys in the exported data were encrypted and the encryption key was not exposed; the same does not apply to credentials recovered from support materials. PingCAP Japan notices: up to about 50,000 personal data records in Japan, with no confirmed unauthorized access to TiDB Cloud itself and no credit card data leakage; an October 21 addition includes support ticket information. Other clients named by FulcrumSec: Pionex and Baidu. PingCAP reported to law enforcement and regulators and confirmed WAF protection on all 16 internet-facing services identified.