PingCAP, a database software company, has told customers to replace access keys after an attacker copied customer records and credentials from its internal systems. Investigators found no evidence that the intruder accessed customers’ live TiDB databases, the company said in an update.
PingCAP develops TiDB database software and runs TiDB Cloud, which businesses use to store and manage information. It disclosed the breach on Oct. 19, saying the unauthorized activity took place between Sept. 9 and Oct. 7. According to the firm, the attacker copied data from PingCAP’s support, billing and internal analytics systems, as well as source code from private repositories.
How the attacker got in
The attacker entered through a compromised GitHub account, according to NebuSec, the cybersecurity firm hired to investigate. Inside PingCAP’s private code and infrastructure files, the intruder found keys and tokens: digital credentials that let software connect to other services. Those credentials opened access to Google Cloud and customer-support tickets.
Some tickets contained Amazon Web Services (AWS) access keys that customers had shared while asking for help. The attacker used those keys to reach cloud storage containing TiDB diagnostic files, the technical records used to investigate database problems. The attacker also obtained PingCAP source code.
On Sept. 23 and 24, the attacker exported 6,458 tables from PingCAP’s internal reporting system, which uses Google’s BigQuery service, into cloud storage. Investigators traced downloads of the stored data between Oct. 2 and 5.
The exposed information included customer names and email addresses, contracts and billing records. Investigators also identified SQL editor history and error messages. Not every customer had every type of information exposed. “We did not protect that information as we should have,” PingCAP CEO Max Liu wrote in an Oct. 23 message to customers.
Which keys need replacing?
An exported table contained encrypted values associated with TiDB Cloud API keys, which software uses to manage the service. These stored values were encrypted, and the decryption key was not exposed, PingCAP said. They could not be used directly. That protection did not cover credentials shared with support, including the AWS keys the attacker used.
PingCAP said it began disabling compromised credentials when it discovered the intrusion Oct. 7 and had disabled all those identified by Oct. 14. It also fixed four software vulnerabilities found in a follow-up code review. NebuSec examined activity records from live systems and found no evidence that those flaws had been exploited.
The firm advised customers to replace active TiDB Cloud management API keys and rotate any credentials or other secrets shared with support. For management API keys, it advises updating applications to use replacements before deleting the old keys. Any key suspected of misuse should be disabled immediately. It also warned of fraudulent requests for passwords, verification codes or payment changes, even if they contain accurate customer details.
PingCAP urged customers to take those precautions without waiting for individual notices while it assesses the exposure for each organization. Its Japanese subsidiary reported that the exposure involved up to approximately 50,000 records of personal information in Japan.