Comment by dherls
1 day ago
If true, this is next level incompetence from PingCap. Apparently the attackers set up a replication pipeline for a month?!
> We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out.
If we were living in a sane world this would end this company. They would lose every customer they have and be buried in lawsuits that bankrupt them into the ground. I hope for sanity, bit I wouldn't be surprised if they stay operating even after that.