PingCAP says hackers stole its source code and customer records, including names, emails and query text. TiDB Cloud users should swap access keys now.
PingCAP, the company behind the TiDB database, has confirmed that an attacker got into its internal systems and stole source code and customer-related data. If your business uses its hosted service, TiDB Cloud, PingCAP advises replacing your management access keys. Phishing emails that look real are the bigger risk to watch for.
PingCAP says the stolen records include user names, email addresses, and which organizations and projects people belong to. They also include text typed into its SQL editor, plus error messages. SQL is the language used to ask a database for information. Some records also contained organization, project and cluster identifiers.
An outside incident response firm found no sign that the attacker ran commands or kept access in the systems it reviewed. PingCAP also says it has no evidence that data stored inside customers' TiDB databases was affected.
A cyber extortion group called FulcrumSec says it took 10.6 TB of data and 413 private code repositories. It also claims it took API keys, billing information and four years of connection logs. None of this has been independently verified. The group says it was inside for many weeks and that some of the credentials could open customer systems.
It also claims about 115,000 access key pairs were taken, with over 40,000 still active. It says it took roughly 1,800 database addresses, some with admin logins, and that engineers pasted customer passwords into support tickets. These are allegations, not findings.
Big brand names have been linked to the data, but that does not mean those companies were hacked. One crypto exchange named in the reports, Bitget, said it found no evidence its user data was exposed.
The main group is customers of TiDB Cloud, along with any staff or data tied to those accounts. Companies that run TiDB on their own servers, and only that, are not described as affected in the material so far. Even customers whose databases were untouched can be exposed, because support tickets and query history can hold sensitive details.
The alert box above lists the steps. The most urgent is replacing active TiDB Cloud management API keys, which are like passwords that let software control your account. Your technical team should also review recent logins for anything unfamiliar.
Security expert Kim Barthel of 42Sec warns that the leaked details could be enough for a convincing phishing email. That means a message that knows who your engineers are, when a contract renews and what you pay. Treat any unexpected email about your account, billing or contract with suspicion, even if it uses accurate details. Check with PingCAP through a known contact before clicking or replying.
If you use TiDB Cloud, replace your management API keys now and distrust unexpected emails about your account, billing or contract.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
