PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken

Teaser from the source

PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used a compromised GitHub account and exposed credentials to access internal systems, copy data and obtain source code. Its IR firm NebuSec says keys harvested from private repos and Terraform state led into Google Cloud, Jira and internal chat, and AWS keys customers had shared in support tickets reached S3 buckets with customers' TiDB diagnostic data. Exported records included TiDB Cloud account and org records, SQL-editor history, CRM, billing and contract data, support tickets and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP says the API-key values were encrypted and the key was not exposed. No evidence data stored in customer TiDB databases was accessed.

This is the RSS-feed teaser. Read the full article at the original source.