PingCAP says an intruder took TiDB Cloud customer data and source code over four weeks
Database vendor PingCAP disclosed that an attacker used stolen service account credentials to get into internal systems between September 9 and October 7. The attacker copied TiDB Cloud account, billing and contract data as well as source code.
Database vendor PingCAP disclosed that an attacker used stolen service account credentials to get into internal systems between September 9 and October 7. The attacker copied TiDB Cloud account, billing and contract data as well as source code. (PingCAP Trust Hub security update; RuntimeWire; TechCrunch)
The data taken included user names and emails, SQL editor text, contract terms and pricing, and a table of encrypted TiDB Cloud API keys. PingCAP says it has found no evidence that data stored in customers' TiDB databases was affected, and that it is still working out the impact on each customer. Extortion group FulcrumSec claims to have 10.6TB of data and plaintext API keys; RuntimeWire reports that PingCAP disputes parts of that account and that the claims are unverified. (PingCAP Trust Hub security update; RuntimeWire; TechCrunch)