PingCAP says TiDB breach copied source code and customer business data
Original title: TiDB Breach Exposes Flawed Cloud Security Assumptions
Stolen service-account credentials allowed access from September 9 to October 7; customer databases were not accessed.
PingCAP disclosed on October 19 that attackers had access to its systems from September 9 to October 7. Using stolen service account credentials, they copied data and source code from the TiDB maker. Its investigation found no customer-database access and no evidence of malicious commands or persistent access, but billing, contract, and pricing data were taken. Downstream customer risk is still being assessed, and PingCAP did not comment to Dark Reading.
Unconfirmed: Whether data the vendor stored about customers creates further downstream risk is still under investigation.
- PingCAP published the notice 12 days after first discovering the incident.
- Investigators found no malicious commands and no persistent access.
- The probe found no access to customers' databases.
- FulcrumSec's leak site lists LexisNexis, Novo Nordisk, and Manchester Airports Group.
- Named TiDB customers include Atlassian, Square, Pinterest, Manus, and Kimi.
Impact: source code plus customer billing, contract, and pricing data
- ATT&CK
- T1078 Valid Accounts
- Vendors
- PingCAP
- Products
- TiDB
- Threat actors
- FulcrumSec
- Victims
- PingCAP
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 7c184611bdd9df51982cc5bb2d5ba649 | vest-cloud-credentials#recipe=similar-items&sourcecontentid=7c184611bdd9df51982cc5bb2d5ba649) APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud |
| md5 | 8f99d4e59eef3c1106085563b00071e8 | t-mythos-exploit-storm#recipe=similar-items&sourcecontentid=8f99d4e59eef3c1106085563b00071e8) CSA: CISOs Should Prepare for Post-Mythos Exploit Storm b |
| md5 | dedc2d87d0611657e649f3ccd3b03e96 | rastructure-crime-bots#recipe=similar-items&sourcecontentid=dedc2d87d0611657e649f3ccd3b03e96) TeamPCP Turns Cloud Infrastructure Into Crime Bots by Jai |
| md5 | e89675326c5a58c3d1742cab0ff9c2e8 | ts-power-offensive-ops#recipe=similar-items&sourcecontentid=e89675326c5a58c3d1742cab0ff9c2e8) Attackers Seize Exposed AI Endpoints to Power Offensive O |
From the original article
9 min read at darkreading.com
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.
By Nate Nelson · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.