PingCAP TiDB Cloud control plane exfiltrated 10.6 TB over 88 undetected exports

Attackers replicated the metadb control plane using credentials committed to public repositories. They ran 88 consecutive six-hour exports from 8 September to 30 September without triggering any detection across GCP, AWS, Jira, or Azure. The haul covers 180,046 tenant organizations, 403,262 emails, 42,612 active API keys, and full gateway logs listing 5 million customer server IPs.

The incident demonstrates systemic absence of egress monitoring in a managed database provider. Customer schemas, migration endpoints with root credentials, and four-year connection histories left the environment in bulk. This directly contradicts PingCAP's multi-tenant security claims and exposes production workloads from banks and e-commerce platforms.

Technology leaks of this scale erode trust faster than individual CVEs because they reveal operational blindness rather than isolated bugs. Shared control-plane credentials and plaintext storage of tenant secrets create persistent attack paths that downstream users cannot mitigate.

Regulatory notifications and customer key rotations are now required. Affected organizations must assume their SQL, IPs, and API keys are compromised and rotate every credential tied to TiDB Cloud endpoints.