--- title: PingCap TiDB Leaks | daily.dev description: A threat actor claims to have exfiltrated 10.6 TB from PingCAP's TiDB Cloud platform, releasing 200 GB as a first stage. The attackers say they ran undetected... canonical: https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PingCap TiDB Leaks | daily.dev og:description: A threat actor claims to have exfiltrated 10.6 TB from PingCAP's TiDB Cloud platform, releasing 200 GB as a first stage. The attackers say they ran undetected... og:url: https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd og:image: https://api.daily.dev/og/posts/87jJWm0Zd.png og:image:alt: PingCap TiDB Leaks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PingCap TiDB Leaks **[Hacker News](https://daily.dev/sources/hn)** · 7 min read · 3 upvotes · 0 comments ## Summary A threat actor claims to have exfiltrated 10.6 TB from PingCAP's TiDB Cloud platform, releasing 200 GB as a first stage. The attackers say they ran undetected for nearly two months, using GCP service-account keys and an Azure service principal committed in PingCAP's own repositories to replicate the control-plane database every six hours, producing 88 consecutive exports with zero detection events. Named customers include Booking.com, Shopee, Airbnb, Pinterest, Databricks, Mercari, and dozens more. Leaked data includes production credentials, 8,027 third-party secret values in a single support-ticket attachment, and a root-password reset vulnerability documented internally in 2022. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What data was allegedly stolen in the PingCAP TiDB Cloud breach? The attackers claim to hold 10.6 TB including the complete TiDB Cloud control plane, billing and finance records, GCP and AWS estates, Jira, CRM, source code, and a four-year log of every customer connection. A 200 GB stage-one release includes tenant IDs mapped to named customers such as Booking.com, Shopee, Airbnb, and Pinterest, plus production credentials and 8,027 live third-party secrets found in a single support-ticket attachment. _Teams running workloads on managed database platforms track incidents like this on daily.dev before their security team does._ ### How did the TiDB Cloud attackers maintain access undetected for two months? The attackers used GCP service-account keys and an Azure service principal found committed in PingCAP's own repositories to stand up a replication feed of the control-plane database. Every six hours for 22 days, the pipeline re-exported every table covering tenants, users, API keys, cluster credentials, changefeeds, and migrations. Eighty-eight consecutive exports ran with zero detection events; the last completed at 06:02 UTC on 30 September. _Developers securing multi-tenant cloud infrastructure follow credential-leak and supply-chain incidents on daily.dev._ ### What was the SECURITY-22 vulnerability in TiDB Cloud? SECURITY-22, documented internally in August 2022, stated that any member of a customer organisation, including a billing-only role, could unconditionally reset the root password of every cluster in that organisation. This gave any low-privilege member full root access to all clusters and their data. The ticket was filed in 2022 and the breach reportedly ran through September 2026, suggesting the issue was never remediated. _Database teams evaluating multi-tenant managed platforms watch for unpatched privilege-escalation findings on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 20 comments across hackernews (as of 2026-10-25). **TL;DR:** Commenters are alarmed by the scale and duration of the alleged breach, with debate over whether the 10.6TB figure represents real customer data or mostly metadata, and pointed jabs at PingCAP's security practices despite a recent audit. **Sentiment:** 0% positive · 15% mixed · 85% skeptical **The pushback** - Credentials committed in PingCAP's own repositories allegedly let attackers set up a replication pipeline for weeks undetected, seen as severe incompetence. - The timing right after an NCC Group security audit is viewed as especially embarrassing. - Some question the credibility of the pentest/security-audit industry generally given this incident. **By community** - hackernews (mixed): Reaction mixes genuine alarm at the breach's scale and duration with skepticism about whether 10.6TB is truly sensitive customer data versus mostly metadata, plus off-topic jokes about Go vs Rust. **Hottest debate:** Whether the leaked 10.6TB represents actual customer data or is mostly low-value metadata given TiDB's scale. **Open questions** - Does the leak actually contain sensitive customer data or primarily operational metadata? - How many customers' personal or production data is genuinely exposed? **Highlights** > If true, this is next level incompetence from PingCap. Apparently the attackers set up a replication pipeline for a month?! > We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out. > — [dherls on hackernews](https://news.ycombinator.com/item?id=50175881) > TiDB is for large scale data. You generally wouldn't use it unless you have at least 1TB of data. 10TB is a single small customer database for them. > — [gregwebs on hackernews](https://news.ycombinator.com/item?id=50176318) > I am reading this as a leak of every possible piece of metadata but not an actual leak of customer data. They have SQL logs which do contain customer data and there is a mention of some snapshots/imports. > — [gregwebs on hackernews · 1 comments](https://news.ycombinator.com/item?id=50175770) > Coming this close on the heels of the security audit by NCC [1] is pretty embarassing for all parties. [1]https://www.pingcap.com/press-release/tidb-ncc-group-securit... > — [xKingfisher on hackernews · 1 comments](https://news.ycombinator.com/item?id=50176489) > only the beginning. next year or two are going to be wild on this front so buckle up... > — [dilyevsky on hackernews](https://news.ycombinator.com/item?id=50176561) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50173716) · 88 points · 20 comments ## Similar posts on daily.dev - [Security briefing: May 2026](https://daily.dev/posts/security-briefing-may-2026-bwmlv6zor) · Sysdig Blog · 0 upvotes · 0 comments - [Best of 2025: Oracle Breach: The Impact is Bigger Than You Think \| Grip](https://daily.dev/posts/best-of-2025-oracle-breach-the-impact-is-bigger-than-you-think-grip-f5mcbzd9c) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PingCap TiDB Leaks","url":"https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd"},"datePublished":"2026-10-21T05:13:39.334Z","dateModified":"2026-10-25T06:37:47.826Z","description":"A threat actor claims to have exfiltrated 10.6 TB from PingCAP's TiDB Cloud platform, releasing 200 GB as a first stage. The attackers say they ran undetected...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"PingCap TiDB Leaks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd#faq","mainEntity":[{"@type":"Question","name":"What data was allegedly stolen in the PingCAP TiDB Cloud breach?","acceptedAnswer":{"@type":"Answer","text":"The attackers claim to hold 10.6 TB including the complete TiDB Cloud control plane, billing and finance records, GCP and AWS estates, Jira, CRM, source code, and a four-year log of every customer connection. A 200 GB stage-one release includes tenant IDs mapped to named customers such as Booking.com, Shopee, Airbnb, and Pinterest, plus production credentials and 8,027 live third-party secrets found in a single support-ticket attachment. Teams running workloads on managed database platforms track incidents like this on daily.dev before their security team does."}},{"@type":"Question","name":"How did the TiDB Cloud attackers maintain access undetected for two months?","acceptedAnswer":{"@type":"Answer","text":"The attackers used GCP service-account keys and an Azure service principal found committed in PingCAP's own repositories to stand up a replication feed of the control-plane database. Every six hours for 22 days, the pipeline re-exported every table covering tenants, users, API keys, cluster credentials, changefeeds, and migrations. Eighty-eight consecutive exports ran with zero detection events; the last completed at 06:02 UTC on 30 September. Developers securing multi-tenant cloud infrastructure follow credential-leak and supply-chain incidents on daily.dev."}},{"@type":"Question","name":"What was the SECURITY-22 vulnerability in TiDB Cloud?","acceptedAnswer":{"@type":"Answer","text":"SECURITY-22, documented internally in August 2022, stated that any member of a customer organisation, including a billing-only role, could unconditionally reset the root password of every cluster in that organisation. This gave any low-privilege member full root access to all clusters and their data. The ticket was filed in 2022 and the breach reportedly ran through September 2026, suggesting the issue was never remediated. Database teams evaluating multi-tenant managed platforms watch for unpatched privilege-escalation findings on daily.dev."}}]} ```