PingCAP confirms breach; FulcrumSec claims 10.6TB stolen from TiDB Cloud
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
PingCAP says stolen service-account credentials gave an intruder access to internal systems from Sep 9 to Oct 7, 2026.
The extortion group's 10.6TB claim is unverified, but downstream TiDB Cloud customers face exposure risk.
Background
PingCAP is a China-based technology company that develops the open-source distributed SQL database TiDB and runs TiDB Cloud, a managed database service for enterprise customers worldwide on a shared, multi-tenant platform. On October 19, 2026, it disclosed that an unauthorized party had used stolen service-account credentials to access internal systems, copy information and obtain source code. The same day, the extortion group FulcrumSec listed PingCAP on its leak site and claimed a far larger haul; security firms say that claim has not been independently verified.
How it unfolded
- 2022An internal record known as SECURITY-22 noted that any member of a customer organisation, including a billing-only role, could reset the root password of every cluster in that organisation.
- Sep 9, 2026An unauthorized party began using stolen service-account credentials to access PingCAP internal systems, copy information and obtain source code, according to PingCAP's report.
- Oct 7, 2026PingCAP detected the incident and began disabling the affected credentials that day.
- Oct 10, 2026PingCAP removed additional compromised credentials, reduced excessive cross-project permissions and enabled extra cloud-storage access logging in an affected project.
- Oct 14, 2026Four vulnerabilities reported by an external incident-response firm were repaired; PingCAP said their discovery does not prove they were the original entry point.
- Oct 19, 2026FulcrumSec added PingCAP and TiDB Cloud to its leak site, and PingCAP published its security incident report confirming unauthorized access to certain internal cloud resources.
- Oct 20, 2026Reports said FulcrumSec claims to have stolen about 10.6 terabytes from TiDB Cloud, affecting records tied to crypto firms such as Bitget.
- Oct 21, 2026Reports said attackers stole 10.6 TB of core data over two months and released an initial data packet exceeding 200 GB.
Who’s saying what
- Official
- PingCAP confirmed the unauthorized access and said data stored in TiDB has not been shown to be affected, with no evidence of attacker command execution or persistence in the production systems reviewed.
- Analysts
- SOCRadar said the leak-site claim has not been independently verified and should be treated as an alleged incident rather than a confirmed breach.
- Caution
- Dark Web Intelligence said the claimed volume and data types are unverified and assessed the listing as a threat-actor claim, not confirmation of a breach.
- Party
- Bitget's Xie Jiayin said investigations confirmed hackers obtained data from TiDB Cloud, but Bitget stored only publicly visible trade log data there, stopped using the services over two months ago and saw no exposure of user data or passwords.
Still unverified
FulcrumSec claims it holds the complete TiDB Cloud control plane, billing, finance, GCP and AWS estates, Jira, CRM, analytics, source code and a four-year connection log — 10.6 TB, 4,901,203 files, 180,046 tenant organisations, 403,262 unique emails, 115,308 plaintext customer API keys (42,612 active) and 413 private source repos. It also says it entered via GCP service-account keys and an Azure service principal committed in PingCAP's repositories, and that PingCAP knew of flaws like multi-tenant isolation and root privilege resets since 2022 without fully patching them. PingCAP has not confirmed the volume or affected-organisation figures, and SOCRadar and Dark Web Intelligence say the claim is unverified. Whether the four repaired vulnerabilities were the original entry point is unresolved.