PingCAP Intrusion Exposes TiDB Cloud Account and Billing Records

An intruder accessed PingCAP’s systems between Sept. 9 and Oct. 7 using stolen service credentials, copying records tied to TiDB Cloud accounts, including billing information.

The access lasted from Sept. 9 to Oct. 7. The copied material included user names, email addresses, project information, SQL editor text and errors, customer contact and billing details, and source code. One exported table held encrypted API-key values.

The review detected neither commands attributed to the intruder nor a lasting presence in the production systems it covered. Their review also found no evidence that data customers stored in TiDB was affected. Those findings are limited to the systems reviewed; the exposure of account and business records is confirmed.

PingCAP detected the intrusion Oct. 7 and began disabling affected credentials that day. By Oct. 14, it had closed the access routes it identified and repaired four vulnerabilities discovered during the investigation.

TiDB Cloud is PingCAP’s managed database service. The company markets TiDB for crypto exchange order histories, wallet systems and on-chain analytics. Bitget has said the data it kept on TiDB Cloud consisted of public trade logs.

PingCAP is still determining which customers were affected and plans to notify them directly once it establishes their individual exposure.