PingCAP, the company behind the TiDB distributed database and its TiDB Cloud service, has confirmed that an unauthorized party spent about a month inside its internal systems, copying business data and source code. The extortion group FulcrumSec has since claimed the theft, alleging it took 10.6 TB of data that includes 413 private code repositories and more than 115,000 customer API keypairs.
PingCAP says the attacker did not touch live customer databases and that API key values in the exported data were encrypted. The group disputes that, and PingCAP says the group’s claims about credentials in support materials have not been verified.
How one compromised account became a month-long intrusion
According to PingCAP’s incident report, an unauthorized party used stolen service account credentials between Sep 9 and Oct 7 to reach internal systems, copy data and obtain source code. A report from forensic firm NebuSec, which PingCAP hired, says the attacker started with a compromised GitHub account and exposed credentials.
NebuSec says keys and tokens found in private repositories and infrastructure configuration let the attacker move into Google Cloud, Jira and an internal chat tool. The firm says 8 Google Cloud service accounts were compromised, with bulk exports from a company data warehouse around Sep 23 and 24 and storage downloads in late September and early October.
The Jira access appears to have widened the damage. Support tickets can contain credentials that customers share while asking for help. NebuSec says those tickets exposed credentials, including cloud keys, that gave access to storage holding some customers’ diagnostic data.
PingCAP says it learned of the incident on Oct 7 and began disabling affected credentials that day. It says all identified compromised credentials were invalidated by Oct 14. NebuSec also reported 4 vulnerabilities discovered by reviewing the stolen source code, all fixed by Oct 14, with no evidence of exploitation.
What PingCAP says was taken
- Source code.
- TiDB Cloud account data, including user names, email addresses, organization and project associations, and SQL editor text and errors.
- Business and billing data, including customer contacts, contract terms, orders, pricing, payment terms and billing configuration.
- According to NebuSec, also Jira issues, support tickets and attachments, internal chat history, marketing and sales records, employee information and infrastructure backups.
PingCAP’s co-founder and CEO took responsibility in a note to customers on Oct 23, writing that the company “did not protect that information as we should have.” PingCAP has not said how many customers are affected, and says it will notify them directly once it establishes customer-specific impact. It has published a list of recommended actions, including replacing TiDB Cloud management API keys, rotating anything shared with support and watching for targeted phishing.
The 10.6 TB claim
FulcrumSec, which appeared on leak sites in April and has since been linked to a string of corporate breaches, claims the haul totals 10.6 TB across 4.9 million files. Its alleged inventory includes 413 private repositories, about 20.6 million customer SQL statements from the cloud SQL editor and chat query features, roughly 377,000 Jira issues and more than 430,000 CRM contacts.
The group also alleges it obtained 115,308 console API keypairs in plaintext, which would directly contradict PingCAP’s statement that the key values were encrypted. It further claims it siphoned data on a recurring schedule from early September through Sep 30, which would put its access window earlier and longer than the one PingCAP describes. None of these figures has been verified.
Leak trackers show the group has already released a first batch of archives totaling roughly 128 GB compressed, and the post promises more. No ransom amount or deadline has been published, and the group has warned that some downstream companies whose credentials sat in support tickets “will be hearing from us soon.” BreachNews has not verified the leaked material.
Why the support tickets matter most
The most consequential risk is probably not PingCAP’s own data. Source code can reveal flaws, but credentials that customers pasted into support tickets are live keys to other organizations’ cloud environments. If any were still valid, the breach could cascade into those customers. PingCAP says whether other usable credentials were exposed is still to be determined, which is why it is telling every customer to rotate anything shared in a ticket, regardless of whether they have been notified.
The pattern matches earlier campaigns attributed to this group. See BreachNews’ coverage of the Novo Nordisk claim, the Hatica breach and the FulcrumSec threat actor profile. PingCAP and NebuSec do not mention law enforcement or regulators.
