Cryptocurrency exchange Bitget said it stored only public data on PingCAP’s TiDB Cloud and stopped using the service more than two months ago, as PingCAP investigates the reach of a security breach.
Bitget said it had placed no sensitive business data on the managed database service. The exchange said it expects no effect on its users or operations and plans to strengthen its oversight of outside technology suppliers.
PingCAP’s Oct. 19 security update identified its internal systems as the source of records copied during the intrusion. The company said it had found no evidence that data stored in TiDB was affected. It has not yet determined which customers’ records were involved.
PingCAP said an intruder used stolen service-account credentials to enter parts of its internal systems between Sept. 9 and Oct. 7. The intruder copied records and obtained source code.
The exported information included user names, email addresses, organization and project associations with some identifiers, SQL editor text, and business and billing information. An exported table also contained encrypted TiDB Cloud API-key values. PingCAP said it was still assessing whether other usable credentials were taken.
PingCAP said it had blocked the unauthorized access routes it identified by Oct. 14. It plans to notify affected customers directly after assessing each customer’s impact.
