PingCAP is urging TiDB Cloud organization owners to replace active management API keys after an intruder copied account and billing records, prompting a warning about targeted phishing.
The company's customer guidance says an exported table contained encrypted API-key values, though PingCAP found no evidence that the values were decrypted or used. It also warned that exposed contact and billing details could help attackers craft targeted phishing messages.
The copied information included user names, email addresses, organization and project associations, SQL editor text and errors, customer contacts, contract terms, orders, pricing, payment terms and billing settings. The intruder also obtained source code. PingCAP is still assessing whether other usable credentials were taken.
PingCAP traced the intrusion to stolen service-account credentials and placed the unauthorized access between Sept. 9 and Oct. 7. PingCAP began disabling affected credentials on Oct. 7, the day it detected the activity. The company has not said how the credentials were stolen.
An outside incident response firm found no evidence that the intruder executed commands or had persistent access in the production systems it examined. PingCAP said its investigation had found no evidence of an impact on data customers stored in TiDB. Those findings do not change the company's account that internal records and source code were copied.
By Oct. 14, PingCAP said it had blocked the access routes it identified and fixed four vulnerabilities discovered during the investigation. Cryptocurrency exchange Bitget said it had kept only public data on TiDB Cloud, as detailed in our earlier coverage of Bitget's response.
PingCAP is determining which customers had records exposed in each category. It plans to contact affected customers directly once it establishes their individual exposure.
