--- title: TiDB Breach Exposes Flawed Cloud Security Assumptions description: Database vendor PingCAP, maker of TiDB, disclosed a breach by extortion group FulcrumSec that may have exposed customer metadata rather than customer databases... canonical: https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TiDB Breach Exposes Flawed Cloud Security Assumptions | daily.dev og:description: Database vendor PingCAP, maker of TiDB, disclosed a breach by extortion group FulcrumSec that may have exposed customer metadata rather than customer databases... og:url: https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq og:image: https://api.daily.dev/og/posts/OokggJbeq.png og:image:alt: TiDB Breach Exposes Flawed Cloud Security Assumptions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TiDB Breach Exposes Flawed Cloud Security Assumptions **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 1 upvotes · 0 comments ## Summary Database vendor PingCAP, maker of TiDB, disclosed a breach by extortion group FulcrumSec that may have exposed customer metadata rather than customer databases themselves. PingCAP says hackers had access from Sept. 9 to Oct. 7 and stole billing data, contract terms, SQL editor text and errors, and an encrypted API key table. FulcrumSec claims the access actually lasted nearly two months, with a replication feed pulling fresh internal data every six hours for 22 days, and says nearly 2,000 organizations in Japan, China and Hong Kong plus 500 Indian ones were affected. Experts warn that SQL query logs and API keys harvested from vendors can expose customer secrets even without a direct database breach. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Did the PingCAP TiDB breach expose customer databases directly? No, PingCAP's investigation found no evidence attackers accessed customer databases directly. Instead, the attackers accessed customers' billing and business data, cloud account and product usage information, SQL editor text and errors, and an encrypted table of API keys, during access that lasted from September 9 to October 7. _Teams weighing vendor risk after a database provider breach can track incident details like this on daily.dev._ ### How long did the FulcrumSec hackers have access to PingCAP's systems? PingCAP stated hackers had access from September 9 to October 7, about one month. FulcrumSec itself claimed the access actually lasted nearly two months, during which it set up a replication feed that automatically pulled fresh copies of PingCAP's internal service management database every six hours for 22 days. _Developers assessing vendor breach disclosures follow conflicting timelines like this through daily.dev._ ### Why are SQL query logs and error histories a security risk when a cloud vendor is breached? Query history and error output can accumulate secrets because engineers sometimes paste connection strings or credentials into a SQL editor while debugging, according to Sysdig strategist Crystal Morin. In the PingCAP breach, exfiltrated SQL statements reportedly exposed a medical clinic's full patient roster and another organization's list of medical professionals. _Engineers hardening database debugging habits can keep up with real-world incidents like this via daily.dev._ ## Similar posts on daily.dev - [PingCap TiDB Leaks](https://daily.dev/posts/pingcap-tidb-leaks-87jjwm0zd) · Hacker News · 2 upvotes · 0 comments - [Best of 2025: Oracle Breach: The Impact is Bigger Than You Think \| Grip](https://daily.dev/posts/best-of-2025-oracle-breach-the-impact-is-bigger-than-you-think-grip-f5mcbzd9c) · Security Boulevard · 1 upvotes · 0 comments - [Security briefing: June 2026](https://daily.dev/posts/security-briefing-june-2026-xqmgytnaq) · Sysdig Blog · 0 upvotes · 0 comments - [Novo Nordisk Breach Exposes Software Development Pipeline Risk](https://daily.dev/posts/novo-nordisk-breach-exposes-software-development-pipeline-risk-mllmtnmow) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TiDB Breach Exposes Flawed Cloud Security Assumptions","url":"https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq"},"datePublished":"2026-10-21T21:44:49.539Z","dateModified":"2026-10-21T22:07:50.801Z","description":"Database vendor PingCAP, maker of TiDB, disclosed a breach by extortion group FulcrumSec that may have exposed customer metadata rather than customer databases...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d77cb04057b027acbbf76b76064247b4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d77cb04057b027acbbf76b76064247b4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,data-breach","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"TiDB Breach Exposes Flawed Cloud Security Assumptions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tidb-breach-exposes-flawed-cloud-security-assumptions-ookggjbeq#faq","mainEntity":[{"@type":"Question","name":"Did the PingCAP TiDB breach expose customer databases directly?","acceptedAnswer":{"@type":"Answer","text":"No, PingCAP's investigation found no evidence attackers accessed customer databases directly. Instead, the attackers accessed customers' billing and business data, cloud account and product usage information, SQL editor text and errors, and an encrypted table of API keys, during access that lasted from September 9 to October 7. Teams weighing vendor risk after a database provider breach can track incident details like this on daily.dev."}},{"@type":"Question","name":"How long did the FulcrumSec hackers have access to PingCAP's systems?","acceptedAnswer":{"@type":"Answer","text":"PingCAP stated hackers had access from September 9 to October 7, about one month. FulcrumSec itself claimed the access actually lasted nearly two months, during which it set up a replication feed that automatically pulled fresh copies of PingCAP's internal service management database every six hours for 22 days. Developers assessing vendor breach disclosures follow conflicting timelines like this through daily.dev."}},{"@type":"Question","name":"Why are SQL query logs and error histories a security risk when a cloud vendor is breached?","acceptedAnswer":{"@type":"Answer","text":"Query history and error output can accumulate secrets because engineers sometimes paste connection strings or credentials into a SQL editor while debugging, according to Sysdig strategist Crystal Morin. In the PingCAP breach, exfiltrated SQL statements reportedly exposed a medical clinic's full patient roster and another organization's list of medical professionals. Engineers hardening database debugging habits can keep up with real-world incidents like this via daily.dev."}}]} ```