PingCAP Inc. / TiDB Cloud • Distributed databases • 10.6 TB total exfiltration • 200 GB stage one release
Today we are making the PingCAP breach public. We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers.
PingCAP sells TiDB Cloud, the managed version of the open-source TiDB database. Banks, game studios and e-commerce platforms hand over their production workloads; PingCAP operates the clusters in a shared, multi-tenant platform, and its entire business rests on the claim that doing so is safe and secure. The rest of this post is the evidence that it is neither.
For one, they seem to have zero visibility into their own cloud services. This is sadly standard among companies we breach, who will invest millions in fancy EDRs but let half a thousand S3 buckets waltz out the door. But this is a cloud provider. It is horrendous and horrendously irresponsible to be seemingly incapable of detecting mass unsubtle compromise and exfiltration of each of their cloud services: AWS, GCP, Atlassian / Jira, Azure. We continued exfiltration over nearly two months, topping up regularly after the initial ~8 terabyte exfil. We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out. Eighty-eight consecutive exports, not one detection event. The last ran at 06:02 UTC on 30 September. The control-plane data it carried is in the stage-one release.
The tenant IDs are not anonymous. PingCAP's own ops audit trail maps them:
Customer | Tenant ID / Detail |
---|---|
Booking.com | tenant 1372813089189081313 |
Shopee | tenant 1372813089191241283 |
CAPCOM CO., LTD | tenant 1372813089188871292, TiDB v6.1.1, ap-northeast-1 |
Colopl | tenant 1326455380288475136, TiDB v6.1.0 |
TOPPAN INC. | prod-1372813089204501289, aws-ap-northeast-1 |
Catalyst Software | prod-1372813089188151289, aws-us-east-1 |
SB Payment Service | prod-1372813089206331321, aws-ap-northeast-1 |
…plus, in the same 42-organisation table and the 94-entry billing dictionary that ships in the eda_service repository: Mercari, PayPay, Fujitsu, SoftBank, DMM, AEON, Square Enix, Konami, BANDAI NAMCO, Delhivery, Flipkart, Quincus, Nylas, Airbnb, Pinterest, Databricks, bitget, Pionex, DigiPlus, NFTscan, Baidu, SES-imagotag, Persona, Transsion, ZOZO, gumi, iret, Classmethod, Wetech, Atlassian, Cygames, SBI, LINE, Chainbase, PatSnap. Their VPC CIDRs are included; their cluster versions and endpoint hostnames are included; for the unlucky ones pasted into support tickets, so are their credentials.
PingCAP's security team wrote down exactly what was wrong with the multi-tenant isolation of their own product in 2022. SECURITY-22, from the internal security tracker, in their own words:
Summary: "The root password of the cluster can be reset unconditionally"
"All roles of the organization (including: owner, audit admin, billing admin, member) can unconditionally reset the root password of all clusters in the organization. This will cause all users in the organization to reset the cluster root password, and then users can connect to the cluster as root, modify the cluster state, and access cluster data."
"Because the root account of the cluster has extremely high privileges, this will lead to a great security risk."
Four years before we walked in, their own security team had documented that any member of a customer organisation — including a billing-only role — could take over every cluster in that organisation as root. The ticket is dated 2022-08. The breach ran through September 2026. A database company.
PingCAP's engineers paste customers' production credentials into Jira tickets. The three worst logs are included whole in the release (02_customer_credential_logs), and the tickets themselves are in 05_jira_issues:
GTOC-5812, 2023-02-01, in-ticket comment (LIVE at time of exfil):
AWS_ACCESS_KEY_ID=AKIAYM5Y2YXDRDJD2IOM AWS_SECRET_ACCESS_KEY=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 aws s3 ls s3://pingcap-logs-pinterest/
APID-11182, attachment 81543_tidb-log.txt, posted 2025-05-02 by [email protected], inside a TiDB BR backup-config line (bucket:"cdx-crs-tidb-backup"):
AKIA2VMQLYWL3LJEHQFC : D7kJLJ2qIcdrjHrusWh5VTygW82hWN1ILirDosS7
ARN arn:aws:iam::733131556247:user/DEVOPS — AdministratorAccess + AmazonS3FullAccess over 258 buckets, including cdx-exp-npci-vault-snapshot, cdx-dev-npci-los-loandoc, cdx-dev-pci-sftp, cdx-sit-npci-lgc-smarttax-cloudhsm, cdx-dev-crs-silverlake-misc-binaries. None of these belonged to PingCAP.
APID-12036, a 314 MB customer production slow-query log attached to a support ticket (attachment 106965, in the release in full). The UPDATE statements contain the customer's per-user credential store: 8,027 distinct values — 7,485 AWS STS session key sets scoped to per-user sandbox repositories, 345 GitHub user-to-server tokens, 192 AI-platform API keys across OpenAI, Anthropic, Gemini, ElevenLabs, xAI and OpenRouter, one AWS root key pair, one GitHub personal access token with 24 administrative scopes over 1,701 repositories (843 private) -- and this is only counting other companies' credentials that are still live. These customers are victims of PingCAP's negligence; particularly the unfortunate companies whose GitHub admin and root AWS credentials were leaked by PingCAP. These two companies' breaches are due entirely to their poor choice of cloud provider, and although we do feel for them, they will be hearing from us soon.
APID-11887, 1,825 distinct production connection strings with embedded username and password, one of which, verbatim:
mysql://3QqgLjKpGPJ9jgG.root:[email protected]:4000/6nyf9vDx56DJcbNfYFeWX6?ssl={"rejectUnauthorized":true}
TCID-2287:
mysql://redbulltest_replicated_tidb:[email protected]:3306/redbulltest_replicated_tidb.*
38 presigned S3 URLs into one customer's own bucket, debank-temp.s3.ap-northeast-1.amazonaws.com, posted across 2024-01-25 → 2026-02-02 by the same support engineer.
Customers entrusted PingCAP with the credentials that connect their applications to the product. PingCAP's tracker then distributed them to whoever holds this data.
The ARR writer logs record every monthly write, per Salesforce account (07_arr_salesforce_logs):
write to salesforce success: {'Month_End_ARR_Amount__c': '2931005.0', 'Account__c': '0015g000002hX2QAAU', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'} write to salesforce success: {'Month_End_ARR_Amount__c': '2100000.0', 'Account__c': '0015g000002hX2SAAU', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'} write to salesforce success: {'Month_End_ARR_Amount__c': '1137016.2', 'Account__c': '001BV000003Ra97YAC', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'}
The Cygames contract is in the finance fixtures with its production numbers: tenant 1372813089191061283, order JP-OF-25030306, net fees $2,400,000, accumulated revenue $2,633,694.97. PatSnap (UK) Ltd's monthly net fees: $136,093.25. FY25 company cloud quota: $29,438,510.37.
And in the China CRM, the sales-activity note reads:
中国人寿，是已经签了商务合同的客户。转移到大客户线索池。
(China Life — a customer with a signed commercial contract. Transferred to the enterprise lead pool.)
The cloud_users crosswalk joins the pseudonymous analytics layer to named people:
{"metadb_user_id": "6150003", "ga4_user_id": "a97cedec6bee3080548ba9209a65f2ab44c6a44e123bdbf84e44c9b832f1f894", "tenant_id": "1", "created_at": "2022-03-30 10:43:08 UTC", "updated_at": "2022-04-02 09:51:45 UTC", "user_email": "[email protected]", "user_email_domain": "pingcap.com", "user_status": "active", "user_first_name": "Sophie", "user_last_name": "Wang", "pseudo_users": [{}]}
Console page URLs carry tenant context: /clusters/10144798180725090481/sqleditor?orgId=1372813089209261904&projectId=1372813089454579595
The Mixpanel user.csv profile table:
[email protected] — Hong Kong, Happy Valley, last seen 2022-08-11 [email protected] — Milpitas, US [email protected] — Osaka, last seen 2022-07-05
Top countries: Japan 774 · China 702 · India 499 · Hong Kong 416 · United States 342. Employers visible in the email domains: Klook, Colopl, Cygames, Booking.com, Mercari, Alibaba, Amazon.
The reo.dev graph they purchased ranks the developers of their target accounts by buying propensity, with business emails and LinkedIn profiles: Tencent 3,327 active developers, Huawei 2,726, ByteDance 2,475, AIG 2,140; 712 named high-intent buyers at Mastercard, Flipkart, bKash, Quark, Actian, eSewa.
Of the 10.6 TB we hold, the stage-one release is five tar.gz archives — 128.3 GB compressed, just over 200 GB uncompressed. More coming soon.
Archive | Size | Contents | Download |
---|---|---|---|
11_cur_tenant_costs.tar.gz | 70.6 GiB | Tenant-attributed AWS cost data, 2022–2026: 92 GB of month-partitioned parquet in which every line item carries resource_tags_user_tenant — the cost to serve every named customer, per cluster, per region, per component, against full savings-plan and reservation pricing — plus the 916,945-result Athena cost-analysis corpus (per-hour dedicated and serverless tier costs, NLB and cross-AZ transfer analyses) | MAGNET | .torrent | ONION |
04_bigquery.tar.gz | 31.5 GiB | The complete BigQuery analytics estate, 83 datasets and 533.8M rows: the metadb control-plane mirror (23.6M rows), the sql_editor view, the cloud_users re-identification crosswalk, GA4 web analytics (108.9M events, 13.6M device identifiers), the salesforce, netsuite and hubspot ingestion datasets, the reo_dev developer-intelligence graph, and 401,911 raw sales-call transcript lines | MAGNET | .torrent | ONION |
10_repos.tar.gz | 17.2 GiB | 413 private repositories with full git history across five GitHub organisations (tidbcloud, pingcap-inc, pingcap, tidb-incubator, Sibyl-TiDB): the billing engine, the account/identity service, the ops portal, the shared crypto library, the internal IT platform, and the SRE audit repositories that map customers to live tenant IDs | MAGNET | .torrent | ONION |
09_gateway_logs.tar.gz | 6.9 GiB | Four years of TiDB Cloud Data Gateway access logs — 23,651 daily files, 41 GB raw: 102,003,766 connections across 846,527 customer clusters, 1,443,915 SQL usernames, 5,036,738 unique client IPs, and the client software fingerprint of each | MAGNET | .torrent |
pingcap_leak_pack_rest.tar.gz | 2.1 GiB | Eight curated collections: 01_decoder_admissions (the SECURITY and HR trackers, production configs, cloudsql_secrets.json, the ops_trail customer→tenant decoder, the 94-name billing dictionary) • 02_customer_credential_logs (the three credential-bearing support logs: the vida BYOK store, the CardX administrator key, the CDC pipeline log) • 03_customer_book (HubSpot, Stripe, AWS Marketplace feeds, China CRM extracts, the Mixpanel identified-user table) • 05_jira_issues (all 377,446 issues across 57 projects) • 06_finance_snapshots (the df_finance and nexuscrm production snapshots of 2026-10-04, helix/pingkai/rd_group ingestions, finance-portal source and terraform state) • 07_arr_salesforce_logs (the monthly ARR writer logs) • 08_firewatch_chats (290 tenant-alert chat exports) | MAGNET | .torrent |
pingcap-stage-one.torrent | 128.3 GiB | All five archives in one download | MAGNET | .torrent |
Contact: [email protected]