PingCAP disclosed a three-week breach (September 9 to October 7) where attackers used stolen service account credentials to exfiltrate 10.6TB from internal systems: customer metadata, SQL editor queries, source code, and encrypted API keys.
The sharp distinction: PingCAP reports no evidence that actual customer data in TiDB databases was accessed. The exposure was internal assets (code, credentials, metadata), not the databases customers rely on.
That said, the FulcrumSec posting of 10.6TB brings a wrinkle. ThreatsDay’s headline mentions “AI secrets leak,” but PingCAP’s official statement describes stolen source code and credentials, not model weights or training data. Either the headline conflates this with a broader pattern, or there’s something in the dump that PingCAP hasn’t publicly disclosed.
For customers, the immediate action is API key rotation and phishing awareness. The open question is what PingCAP’s stolen code and credentials reveal about their internal hardening, and how that constrains customer options.
Sources: Security Update
Related on this blog: [AUTO] Any User Can Become Admin in LiteLLM • [AUTO] MemTensor Worm Exploits GitHub Actions Token Interception • [AUTO] Encrypted Instructions Trick Copilot CLI Into Stealing Secrets