TIDB BREACH EXPOSES FLAWED CLOUD SECURITY ASSUMPTIONS

Summary from the TLDR InfoSec newsletter

PingCAP disclosed that attackers used stolen service-account credentials to access TiDB systems from September 9 to October 7, copying data and source code. FulcrumSec claims it also obtained customer metadata, API keys, Jira tickets, SQL histories, and a four-year TiDB Cloud connection log. Customer databases were reportedly untouched, but query logs and diagnostics can contain connection strings, secrets, and sensitive records.