PingCap TiDB Leaks

THE LEAKS PingCAP Inc. / TiDB Cloud • Distributed databases • 10.6 TB total exfiltration • 200 GB stage one release 10.6 TB total exfil • 4,901,203 files • 88 consecutive six-hourly exports of the production control plane, undetected • ~50 GCP storage buckets • a 533.8-million-row BigQuery warehouse • 180,046 tenant organisations • 403,262 unique emails • 115,308 plaintext customer API keys, 42,612 active • 20,645,574 customer SQL statements • 102,003,766 gateway connections • 5,036,738 customer server IPs • 377,446 Jira issues • 433,928 CRM contacts • 92 GB of tenant-tagged AWS cost data • 413 private source repos Today we are making the PingCAP breach public. We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers. PingCAP sells TiDB Cloud, the managed version of the open-source TiDB database. Banks, game studios and e-commerce platforms hand over their production workloads; PingCAP operates the clusters in a shared, multi-tenant platform, and its entire business rests on the claim that doing so is safe and secure. The rest of this post is the evidence that it is neither. For one, they seem to have zero visibility into their own cloud services. This is sadly standard among companies we breach, who will invest millions in fancy EDRs but let half a thousand S3 buckets waltz out the door. But this is a cloud provider. It is horrendous and horrendously irresponsible to be seemingly incapable of detecting mass unsubtle compromise and exfiltration of each of their cloud services: AWS, GCP, Atlassian / Jira, Azure. We continued exfiltration over nearly two months, topping up regularly after the initial ~8 terabyte exfil. We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out. Eighty-eight consecutive exports, not one detection event. The last ran at 06:02 UTC on 30 September. The control-plane data it carried is in the stage-one release. What We Took The control plane. metadb, replicated in full: 180,046 tenant organisations, 292,276 user records with 166,108 real names, 403,262 unique emails, 388,861 projects, 3,448,054 serverless clusters, 16,299 dedicated clusters, 115,308 console API keypairs stored in plaintext (42,612 active; the newest was minted at 04:46 on 30 September, hours before we closed the tap), 1,809 external database endpoints from customer migration jobs — root and admin accounts on customer MySQL/Aurora hosts — plus 290 customer AWS account IDs and 85 GCP project IDs from VPC peering records. The customers' own SQL. 20,645,574 raw SQL statements captured from the SQL Editor and Chat2Query — the application schemas, table designs and business logic of thousands of tenants, keyed by org, project and cluster ID. One statement creates a table of medical professionals (usuario, nombre_usuario, contrasena); another inserts a Brazilian clinic's patient roster. This is the contents of customer databases, captured by the product itself and shipped to us by PingCAP's own pipeline. The targeting map. The gateway access logs are the installed-base directory of a database company: every customer's connection volume, their app-server IP addresses, their client programs (Rails 0.46M connections, ProxySQL, MySQL Workbench, langgenius/dify), their cluster IDs. Anyone planning further access to TiDB Cloud customers starts here. All 23,651 daily files are in 09_gateway_logs.tar.gz. The money. The CUR corpus with resource_tags_user_tenant turns PingCAP's cost-to-serve per customer into a spreadsheet join: 57 months of AWS spend totalling $107,195,238.42, EDP discount −$10,362,705.51 and private rates −$8,829,018.11 (~47% off list), us-east-1 cross-AZ transfer alone at $16,509,714.87. Combine with the finance-DB snapshots (per-tenant net fees, monthly_cloud_order, the AR table, dbaas_billing at 8.8M rows) and the ARR writer logs, and the gross margin of TiDB Cloud, per named customer, per product family, is a SQL query. The commercial book. HubSpot: 433,928 contacts, 191,187 companies, deals nominally worth $552M — Wetech $74.7M, PayPay $45.2M, Atlassian $25.8M, SBI $20.2M, AEON $10.7M, TOPPAN $9.7M. Stripe: all 8,428 paying tenants, livemode, with 8,301 tenant IDs joined to Stripe accounts. NetSuite revenue ledgers for 584 named customers. AWS Marketplace: 861 buyer street addresses, 48,991 subscriber agreements. The China ledger: 12,262 revenue-recognition rows totalling ¥353.1M, with Bank of China, the Ministry of Science and Technology and China Life among the customers. The source code. 413 repositories. The billing engine that trusts unverified X-ACCOUNT-USER-ID headers. The account service where admin is a tenant ID and impersonation bypasses org checks with owner role. The shared crypto library, pkgv2: AES-CBC with the IV derived from the key prefix — a static IV — instantiated with a single server-wide SaltSecret; every encrypted customer downstream-database password in the platform is one config secret from plaintext. The identity graph. 13,620,173 GA4 device identifiers over 108,871,828 events; the cloud_users crosswalk (290,458 rows) that joins hashed user IDs to emails and employer tenant IDs; 2,895,030 rows linking logged-in identities to cookie trails; Mixpanel exports with 3,552 full named profiles; 24,932 personal emails with LinkedIn and GitHub profiles from the reo.dev developer-intelligence graph PingCAP purchased — Tencent's 3,327 most active engineers, Huawei's 2,726, ByteDance's 2,475, ranked by their propensity to buy. The Customers in the Records The tenant IDs are not anonymous. PingCAP's own ops audit trail maps them: …plus, in the same 42-organisation table and the 94-entry billing dictionary that ships in the eda_service repository: Mercari, PayPay, Fujitsu, SoftBank, DMM, AEON, Square Enix, Konami, BANDAI NAMCO, Delhivery, Flipkart, Quincus, Nylas, Airbnb, Pinterest, Databricks, bitget, Pionex, DigiPlus, NFTscan, Baidu, SES-imagotag, Persona, Transsion, ZOZO, gumi, iret, Classmethod, Wetech, Atlassian, Cygames, SBI, LINE, Chainbase, PatSnap. Their VPC CIDRs are included; their cluster versions and endpoint hostnames are included; for the unlucky ones pasted into support tickets, so are their credentials. The Warning Was Already in Jira PingCAP's security team wrote down exactly what was wrong with the multi-tenant isolation of their own product in 2022. SECURITY-22, from the internal security tracker, in their own words: Summary: "The root password of the cluster can be reset unconditionally" "All roles of the organization (including: owner, audit admin, billing admin, member) can unconditionally reset the root password of all clusters in the organization. This will cause all users in the organization to reset the cluster root password, and then users can connect to the cluster as root, modify the cluster state, and access cluster data." "Because the root account of the cluster has extremely high privileges, this will lead to a great security risk." Four years before we walked in, their own security team had documented that any member of a customer organisation — including a billing-only role — could take over every cluster in that organisation as root. The ticket is dated 2022-08. The breach ran through September 2026. A database company. The 'Support Operation' as a Cross-Tenant Disclosure Engine PingCAP's engineers paste customers' production credentials into Jira tickets. The three worst logs are included whole in the release (02_customer_credential_logs), and the tickets themselves are in 05_jira_issues: GTOC-5812, 2023-02-01, in-ticket comment (LIVE at time of exfil): AWS_ACCESS_KEY_ID=AKIAYM5Y2YXDRDJD2IOM AWS_SECRET_ACCESS_KEY=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 aws s3 ls s3://pingcap-logs-pinterest/ APID-11182, attachment 81543_tidb-log.txt, posted 2025-05-02 by [email protected], inside a TiDB BR backup-config line (bucket:"cdx-crs-tidb-backup"): AKIA2VMQLYWL3LJEHQFC : D7kJLJ2qIcdrjHrusWh5VTygW82hWN1ILirDosS7 ARN arn:aws:iam::733131556247:user/DEVOPS — AdministratorAccess + AmazonS3FullAccess over 258 buckets, including cdx-exp-npci-vault-snapshot, cdx-dev-npci-los-loandoc, cdx-dev-pci-sftp, cdx-sit-npci-lgc-smarttax-cloudhsm, cdx-dev-crs-silverlake-misc-binaries. None of these belonged to PingCAP. APID-12036, a 314 MB customer production slow-query log attached to a support ticket (attachment 106965, in the release in full). The UPDATE statements contain the customer's per-user credential store: 8,027 distinct values — 7,485 AWS STS session key sets scoped to per-user sandbox repositories, 345 GitHub user-to-server tokens, 192 AI-platform API keys across OpenAI, Anthropic, Gemini, ElevenLabs, xAI and OpenRouter, one AWS root key pair, one GitHub personal access token with 24 administrative scopes over 1,701 repositories (843 private) -- and this is only counting other companies' credentials that are still live. These customers are victims of PingCAP's negligence; particularly the unfortunate companies whose GitHub admin and root AWS credentials were leaked by PingCAP. These two companies' breaches are due entirely to their poor choice of cloud provider, and although we do feel for them, they will be hearing from us soon. APID-11887, 1,825 distinct production connection strings with embedded username and password, one of which, verbatim: mysql://3QqgLjKpGPJ9jgG.root:[email protected]:4000/6nyf9vDx56DJcbNfYFeWX6?ssl={"rejectUnauthorized":true} TCID-2287: mysql://redbulltest_replicated_tidb:[email protected]:3306/redbulltest_replicated_tidb.* 38 presigned S3 URLs into one customer's own bucket, debank-temp.s3.ap-northeast-1.amazonaws.com, posted across 2024-01-25 → 2026-02-02 by the same support engineer. Customers entrusted PingCAP with the credentials that connect their applications to the product. PingCAP's tracker then distributed them to whoever holds this data. The Margin, Per Customer The ARR writer logs record every monthly write, per Salesforce account (07_arr_salesforce_logs): write to salesforce success: {'Month_End_ARR_Amount__c': '2931005.0', 'Account__c': '0015g000002hX2QAAU', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'} write to salesforce success: {'Month_End_ARR_Amount__c': '2100000.0', 'Account__c': '0015g000002hX2SAAU', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'} write to salesforce success: {'Month_End_ARR_Amount__c': '1137016.2', 'Account__c': '001BV000003Ra97YAC', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'} The Cygames contract is in the finance fixtures with its production numbers: tenant 1372813089191061283, order JP-OF-25030306, net fees $2,400,000, accumulated revenue $2,633,694.97. PatSnap (UK) Ltd's monthly net fees: $136,093.25. FY25 company cloud quota: $29,438,510.37. And in the China CRM, the sales-activity note reads: 中国人寿，是已经签了商务合同的客户。转移到大客户线索池。 (China Life — a customer with a signed commercial contract. Transferred to the enterprise lead pool.) Customers in the Identity Graph The cloud_users crosswalk joins the pseudonymous analytics layer to named people: {"metadb_user_id": "6150003", "ga4_user_id": "a97cedec6bee3080548ba9209a65f2ab44c6a44e123bdbf84e44c9b832f1f894", "tenant_id": "1", "created_at": "2022-03-30 10:43:08 UTC", "updated_at": "2022-04-02 09:51:45 UTC", "user_email": "[email protected]", "user_email_domain": "pingcap.com", "user_status": "active", "user_first_name": "Sophie", "user_last_name": "Wang", "pseudo_users": [{}]} Console page URLs carry tenant context: /clusters/10144798180725090481/sqleditor?orgId=1372813089209261904&projectId=1372813089454579595 The Mixpanel user.csv profile table: [email protected] — Hong Kong, Happy Valley, last seen 2022-08-11 [email protected] — Milpitas, US [email protected] — Osaka, last seen 2022-07-05 Top countries: Japan 774 · China 702 · India 499 · Hong Kong 416 · United States 342. Employers visible in the email domains: Klook, Colopl, Cygames, Booking.com, Mercari, Alibaba, Amazon. The reo.dev graph they purchased ranks the developers of their target accounts by buying propensity, with business emails and LinkedIn profiles: Tencent 3,327 active developers, Huawei 2,726, ByteDance 2,475, AIG 2,140; 712 named high-intent buyers at Mastercard, Flipkart, bKash, Quark, Actian, eSewa. Initial Release Of the 10.6 TB we hold, the stage-one release is five tar.gz archives — 128.3 GB compressed, just over 200 GB uncompressed. More coming soon. Contact: [email protected]