PingCAP Inc. sells TiDB Cloud as the managed, secure version of its open-source distributed database. Banks, game studios, e-commerce platforms, and payment processors hand over production workloads on the promise that multi-tenant isolation works. A threat actor calling itself FulcrumSec has now published evidence that it does not — 10.6 terabytes of it, comprising the complete control plane, billing estate, source code, CRM, Jira, analytics pipelines, and a four-year log of every connection every customer ever made. The breach ran for approximately two months through September 2026. The attacker used GCP service-account keys and an Azure service principal found committed in PingCAP's own repositories to stand up a replication feed of the production control-plane database. Every six hours for 22 consecutive days — 88 exports total — the company's own infrastructure faithfully re-exported tenant records, user accounts, API keys, cluster credentials, and migrations, and pushed them out. Not one detection event was triggered. The last export ran at 06:02 UTC on 30 September. The scale of customer exposure is staggering. The control-plane database (metadb) contained 180,046 tenant organisations, 403,262 unique emails, 115,308 console API keypairs stored in plaintext (42,612 still active at time of exfiltration), and 1,809 external database endpoints from customer migration jobs — root and admin accounts on customer MySQL and Aurora hosts. The gateway access logs — 23,651 daily files — map every customer's connection volume, application-server IP addresses, and client programs. Named tenants include Booking.com, Shopee, CAPCOM, TOPPAN, Mercari, PayPay, Square Enix, Konami, Bandai Namco, Flipkart, Airbnb, Pinterest, Databricks, and Atlassian, with VPC CIDRs, cluster versions, and endpoint hostnames included. Beyond the control plane, the attacker captured 20,645,574 raw customer SQL statements from PingCAP's SQL Editor and Chat2Query features — application schemas, table designs, and business logic keyed by tenant. One statement creates a table of medical professionals with plaintext credentials; another inserts a Brazilian clinic's patient roster. The financial corpus includes 57 months of AWS spend totalling $107.2 million, per-tenant billing at 8.8 million rows, and HubSpot CRM data covering 433,928 contacts and deals nominally worth $552 million. The 413 private source repositories revealed architectural defects: the billing engine trusts unverified HTTP headers for tenant identity, the account service allows admin impersonation bypassing org checks, and the shared crypto library uses AES-CBC with a static IV derived from a single server-wide secret — meaning every encrypted customer database password is one config leak from plaintext. PingCAP's own security team had documented the core vulnerability in 2022. Internal Jira ticket SECURITY-22, dated August 2022, warned that any member of a customer organisation — including billing-only roles — could unconditionally reset the root password of every cluster in that organisation. The ticket called it 'a great security risk.' Four years later, the breach ran through the same infrastructure. Separately, PingCAP engineers routinely pasted customer production credentials into Jira tickets: live AWS access keys for Pinterest's log bucket, an AWS IAM key with AdministratorAccess over 258 buckets (including NPCI vault snapshots and PCI-scoped storage), and a 314 MB slow-query log containing 8,027 distinct third-party credentials — AWS STS session keys, GitHub tokens, OpenAI and Anthropic API keys, and a GitHub PAT with admin scope over 1,701 repositories. This is not a sophisticated zero-day exploitation. It is a cloud database provider that committed its own infrastructure credentials to source repos, ran no exfiltration detection across AWS, GCP, Azure, and Atlassian simultaneously, stored API keys in plaintext, used broken cryptography for customer passwords, and allowed its support workflows to become a cross-tenant credential disclosure engine. Every layer of the multi-tenant trust model failed, and every layer had been internally documented as failing. The 88 undetected exports are not the vulnerability — they are the symptom of an organisation that sold security it did not possess. The downstream risk is compounding. The exfiltrated data is not just PingCAP's — it is the operational map to thousands of customer environments: their IP addresses, their database schemas, their credentials pasted into support tickets, their AWS account IDs, their VPC configurations. Any secondary attacker with access to this dataset starts with a targeting advantage that normally takes months of reconnaissance to build. The stage-one release is 200 GB; 10.4 TB remains.
