https://pwn.watch/t/pingcap Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 09:20:00 GMT https://pwn.watch/i/pingcap-tidb-cloud-breach https://pwn.watch/i/pingcap-tidb-cloud-breach Thu, 22 Oct 2026 09:20:00 GMT high <p>PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-21: PingCAP Japan adds support-ticket information to the list of exposed data. (<a href="https://pingcap.co.jp/trust-hub/security/security-update-october-2026/">source</a>)</li><li>2026-10-20: FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. (<a href="https://cryptobriefing.com/bitget-no-user-data-tidb-cloud-breach/">source</a>)</li><li>2026-10-19: PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. (<a href="https://pingcap.co.jp/trust-hub/security/security-update-october-2026/">source</a>)</li></ul>