INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

TiDB Cloud Security Flaw Exposed

| 2026-10-21 21:15 MEDIUM HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A breach of PingCAP, a software maker that sells an open source database program called TiDB, occurred on October 19, 2026. The attackers, identified as Fulcrum Security or FulcrumSec, gained access to PingCAP's systems using stolen service account credentials from September 9 to October 7. Approximately 2,000 organizations in Japan, China, and Hong Kong were affected, with an additional 500 from India. The hackers accessed customers' billing and business data, including contract terms, pricing, cloud accounts, product usage information, email addresses, SQL editor text, and errors, as well as encrypted API keys. Despite the severity of the breach, investigators found no evidence that attackers ran malicious commands or maintained persistent access in PingCAP's systems, nor did they access any customers' databases.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA aviationaviation healthhealth technologytechnology
Incident Timeline
‎Oct. 19
Threat actors exploited a vulnerability in TiDB, an SQL database program sold by PingCAP, to breach the system on October 19.
organisation SQL
On Oct. 19, software maker PingCAP, which sells an SQL database program called TiDB, disclosed that it had been breached.
organisation TiDB
On Oct. 19, software maker PingCAP, which sells an SQL database program called TiDB, disclosed that it had been breached.
‎Sept. 9 to Oct. 7
Hackers gained unauthorized access to PingCAP's systems from September 9 to October 7.
‎2026/10/21
Fulcrum Security, a relatively new extortionist group, claimed to have stolen 640GB of data from PingCAP's Google Cloud storage.
organisation Pinterest
According to PingCAP's website, it serves major American corporations like Atlassian, Square, and Pinterest, as well as major players in China's artificial intelligence (AI) space, including Manus, Kimi, and more.
victims 2,000 affected organizations
Asia represented the biggest slice of the pie, with nearly 2,000 affected organizations in Japan, China, and Hong Kong, with another 500 from India.
organisation Booking.com
The attackers fingered individual enterprises caught in the crossfire: brand name US companies like AirBnB and Booking.com, Asian corporate giants like Baidu and Fujitsu, and a few of the world's biggest video game companies, including Capcom, Konami, and Square Enix.
organisation Baidu
The attackers fingered individual enterprises caught in the crossfire: brand name US companies like AirBnB and Booking.com, Asian corporate giants like Baidu and Fujitsu, and a few of the world's biggest video game companies, including Capcom, Konami, and Square Enix.
organisation Fujitsu
The attackers fingered individual enterprises caught in the crossfire: brand name US companies like AirBnB and Booking.com, Asian corporate giants like Baidu and Fujitsu, and a few of the world's biggest video game companies, including Capcom, Konami, and Square Enix.
organisation Capcom
The attackers fingered individual enterprises caught in the crossfire: brand name US companies like AirBnB and Booking.com, Asian corporate giants like Baidu and Fujitsu, and a few of the world's biggest video game companies, including Capcom, Konami, and Square Enix.
organisation TiDB Breach
TiDB Breach Exposes Flawed Cloud Security Assumptions.
organisation FulcrumSec
The perpetrator — the somewhat deceptively named "Fulcrum Security," or FulcrumSec, for short — is a relatively new extortionist group whose leak site already includes major organizations like LexisNexis, Novo Nordisk, and the Manchester Airports Group (MAG).
organisation LexisNexis
The perpetrator — the somewhat deceptively named "Fulcrum Security," or FulcrumSec, for short — is a relatively new extortionist group whose leak site already includes major organizations like LexisNexis, Novo Nordisk, and the Manchester Airports Group (MAG).
organisation the Manchester Airports Group
The perpetrator — the somewhat deceptively named "Fulcrum Security," or FulcrumSec, for short — is a relatively new extortionist group whose leak site already includes major organizations like LexisNexis, Novo Nordisk, and the Manchester Airports Group (MAG).
organisation MAG
The perpetrator — the somewhat deceptively named "Fulcrum Security," or FulcrumSec, for short — is a relatively new extortionist group whose leak site already includes major organizations like LexisNexis, Novo Nordisk, and the Manchester Airports Group (MAG).
organisation Marvell
Related: Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security The even bigger issue is whether the breach exposed downstream customers' sensitive data.
organisation Microsoft & Oracle Work to
Related: Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security The even bigger issue is whether the breach exposed downstream customers' sensitive data.
organisation Standardize Data Center
Related: Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security The even bigger issue is whether the breach exposed downstream customers' sensitive data.
organisation API
They also exported a table with encrypted API keys, though investigators said the encryption protected the keys from actually being used maliciously.
organisation TiDB Cloud
In a name-and-shame post to its leak site, the hackers claimed to be in possession of all of PingCAP's service management records, its financial records, its files stored within Google Cloud, Jira support tickets, customer relationship management (CRM) data, analytics data, source code, plus a four-year-long log of every connection every one of its customers ever made to the TiDB Cloud service.
organisation Manchester Airports Group
Last summer, for example, the group breached Manchester Airports Group (MAG), claiming to have stolen 86GB of data.
data_breach 86 GB
Last summer, for example, the group breached Manchester Airports Group (MAG), claiming to have stolen 86GB of data.
And whereas some hackers exaggerate their winnings, this case was something of the opposite: that initial 86GB claim in fact represented compressed data.
organisation PII
That data turned out to contain far more genuine personally identifiable information (PII) than MAG copped to, according to reporting by BleepingComputer .
organisation Keeper Security
Keeper Security chief information security officer (CISO) Shane Barney seconds Morin's point.
organisation Morin
Keeper Security chief information security officer (CISO) Shane Barney seconds Morin's point.
data_breach 640 GB
The hackers clarified that the actual, uncompressed total stolen was actually 640GB.
‎2026/11/02
Hackers gained unauthorized access to PingCAP's systems from September 9 to October 7, exposing TiDB customers to potential risks.
Tactical Metrics
Metrics
victims
2,000
Affected Organizations
Asia represented the biggest slice of the pie, with nearly 2,000 affected organizations in Japan, China, and Hong Kong, with another 500 from India.
Metrics
data_breach
86
Gb
Last summer, for example, the group breached Manchester Airports Group (MAG), claiming to have stolen 86GB of data.
And whereas some hackers exaggerate their winnings, this case was something of the opposite: that initial 86GB claim in fact represented compressed data.
Metrics
data_breach
640
Gb
The hackers clarified that the actual, uncompressed total stolen was actually 640GB.
Intelligence Sources
Dark Reading 2026-10-21