PingCap TiDB Leaks
swyx
93 points
13 comments
October 20, 2026
Related Discussions
Found 5 related stories in 110.0ms across 10,084 title embeddings via pgvector HNSW
- TFTP Honey Pot Results speckx · 70 pts · July 13, 2026 · 45% similar
- Tailcat – Like netcat, but over Tailscale’s data plane nderjung · 525 pts · August 26, 2026 · 45% similar
- A flaky test exposed a Redis client use-after-free DrNemski · 38 pts · July 22, 2026 · 44% similar
- I captured 72 hours of idle Android packets behind pfSense youngmanyk · 42 pts · September 19, 2026 · 43% similar
- Tailcat: Tailscale Without Tailscale, by Tailscale ricochet11 · 63 pts · September 01, 2026 · 42% similar
Discussion Highlights (7 comments)
rvz
First the Google Cloud outage [0], then the CA private key leak [1]... ...and now this... > Today we are making the PingCAP breach public. We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers. This is an entire leak of ALL PingCap TiDB's customers AND data. All of this in a single day. It is over. [0] https://news.ycombinator.com/item?id=50163961 [1] https://news.ycombinator.com/item?id=50166579
arpinum
AWS private rates gives PingCAP ~47% off list price. Wonder which services got the biggest discounts? Unsurprisingly for a db company the cross-az traffic is 15% of their bill.
dangoodmanUT
what is happening today and how are people not talking about this more
dherls
If true, this is next level incompetence from PingCap. Apparently the attackers set up a replication pipeline for a month?! > We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out.
nemothekid
Man I recently executed a migration from Aurora to Planetscale. I seriously considered PingCap but decided against it because I thought they cloud pricing was too complex. I wonder if my personal information is in the leak.
esafak
https://www.moxfive.com/blog/who-is-fulcrumsec-inside-the-cl...
xKingfisher
Coming this close on the heels of the security audit by NCC [1] is pretty embarassing for all parties. [1] https://www.pingcap.com/press-release/tidb-ncc-group-securit...