PingCAP database and customer data suspected stolen by hackers, involving firms such as Bitget and Pionex

On October 20, the hacker group FULCRUMSEC publicly disclosed an attack on TiDB Cloud, the managed platform under distributed database provider PingCAP. Over the past two months, the attackers continuously infiltrated systems using cloud credentials leaked from its codebase, cumulatively stealing 10.6 TB of core data and releasing over 200 GB of data in the first phase. Leak records indicate that blockchain-related companies such as Bitget, Pionex, DigiPlus, NFTscan, and Chainbase, as well as well-known multinational corporations including Booking.com, Shopee, and Capcom, are among the affected parties.

This breach encompasses 180,000 tenant organizations, over 400,000 distinct email addresses, 115,000 plaintext application programming interface (API) keys (of which 42,000 are active), as well as over 20.6 million customer production environment SQL statements, over 100 million gateway connection logs, and more than 5 million server IP addresses. Additionally, 413 private source code repositories, internal ticketing system records, cloud service financial invoices, and customer relationship management data fall within the scope of this disclosure.

The attackers noted that certain production credentials and access keys for affected customers have remained in support tickets and logs for an extended period, and that PingCAP had internally recorded security vulnerabilities—including issues with multi-tenant isolation and root privilege resets—as early as 2022 but failed to fully remediate them. As of now, the relevant platform has not issued an official public response to this data breach.

Note: At present, the authenticity of the relevant data and the exact scope of the impact have not been independently verified, nor is there evidence suggesting that user assets of the aforementioned exchanges have been adversely affected.