”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”
The evidence is in the blog post explaining how they did it. However seeing at how bad their operations were I doubt they have evidence of anything themselves
> We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out. Eighty-eight consecutive exports, not one detection event.
Related ongoing thread:
PingCap TiDB Leaks - https://news.ycombinator.com/item?id=50173716 - Oct 2026 (32 comments)
(It had only spent 3 hours on the frontpage so I re-upped it.)
I guess I picked the wrong week to stop sniffing glue.
Surely you can't be serious
I am. And don't call me Shirly
I find it wild how much they have downplayed this in their statement. https://www.pingcap.com/trust-hub/security/security-update-o...
”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”
hmm, I don't think that's true.
"Found no evidence" doesn't mean it didn't happen, it means the incident response firm didn't find it.
The evidence is in the blog post explaining how they did it. However seeing at how bad their operations were I doubt they have evidence of anything themselves
Plaid is listed as a customer. Good times.
That was a single company, the cert problem hit something like 70% of all websites and devices.
Honestly…I’ve never heard of pingcap
Jesus that one is bad
I can’t even
Utterly humiliating.