原文：https://t.co/f8XWUL4uWw 以及pingcap 泄露的数据下载

各位大佬，能挖出什么有价值的信息就看你的Agent是否牛逼了，另外有啥有价值的信息记得来跟我说说哈 https://t.co/RXccIv4ZXv

The PingCAP TiDB Cloud Leaks

Source: https://fulcrumsec.vg/pingcap/ ← FULCRUMSEC

PingCAP Inc. / TiDB Cloud • Distributed databases • 10.6 TB total exfiltration • 200 GB stage one release

10.6 TB total exfil • 4,901,203 files • 88 consecutive six-hourly exports of the production control plane, undetected • ~50 GCP storage buckets • a 533.8-million-row BigQuery warehouse • 180,046 tenant organisations • 403,262 unique emails • 115,308 plaintext customer API keys, 42,612 active • 20,645,574 customer SQL statements • 102,003,766 gateway connections • 5,036,738 customer server IPs • 377,446 Jira issues • 433,928 CRM contacts • 92 GB of tenant-tagged AWS cost data • 413 private source repos

Today we are making the PingCAP breach public. We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers.

PingCAP sells TiDB Cloud, the managed version of the open-source TiDB database. Banks, game studios and e-commerce platforms hand over their production workloads; PingCAP operates the clusters in a shared, multi-tenant platform, and its entire business rests on the claim that doing so is safe and secure. The rest of this post is the evidence that it is neither.

For one, they seem to have zero visibility into their own cloud services. This is sadly standard among companies we breach, who will invest millions in fancy EDRs but let half a thousand S3 buckets waltz out the door. But this is a cloud provider. It is horrendous and horrendously irresponsible to be seemingly incapable of detecting mass unsubtle compromise and exfiltration of each of their cloud services: AWS, GCP, Atlassian / Jira, Azure. We continued exfiltration over nearly two months, topping up regularly after the initial ~8 terabyte exfil. We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out. Eighty-eight consecutive exports, not one detection event. The last ran at 06:02 UTC on 30 September. The control-plane data it carried is in the stage-one release.

What We Took

• **The control plane.**metadb, replicated in full: 180,046 tenant organisations, 292,276 user records with 166,108 real names, 403,262 unique emails, 388,861 projects, 3,448,054 serverless clusters, 16,299 dedicated clusters, 115,308 console API keypairs stored in plaintext (42,612 active; the newest was minted at 04:46 on 30 September, hours before we closed the tap), 1,809 external database endpoints from customer migration jobs — root and admin accounts on customer MySQL/Aurora hosts — plus 290 customer AWS account IDs and 85 GCP project IDs from VPC peering records.
• **The customers’ own SQL.**20,645,574 raw SQL statements captured from the SQL Editor and Chat2Query — the application schemas, table designs and business logic of thousands of tenants, keyed by org, project and cluster ID. One statement creates a table of medical professionals (usuario, nombre_usuario, contrasena); another inserts a Brazilian clinic’s patient roster. This is the contents of customer databases, captured by the product itself and shipped to us by PingCAP’s own pipeline.
• **The targeting map.**The gateway access logs are the installed-base directory of a database company: every customer’s connection volume, their app-server IP addresses, their client programs (Rails 0.46M connections, ProxySQL, MySQL Workbench, langgenius/dify), their cluster IDs. Anyone planning further access to TiDB Cloud customers starts here. All 23,651 daily files are in 09_gateway_logs.tar.gz.
• **The money.**The CUR corpus with resource_tags_user_tenant turns PingCAP’s cost-to-serve per customer into a spreadsheet join: 57 months of AWS spend totalling 107,195,238\.42, EDP discount −10,362,705.51 and private rates −$8,829,018.11 (~47% off list), us-east-1 cross-AZ transfer alone at $16,509,714.87. Combine with the finance-DB snapshots (per-tenant net fees, monthly_cloud_order, the AR table, dbaas_billing at 8.8M rows) and the ARR writer logs, and the gross margin of TiDB Cloud, per named customer, per product family, is a SQL query.
• **The commercial book.**HubSpot: 433,928 contacts, 191,187 companies, deals nominally worth $552M — Wetech $74.7M, PayPay $45.2M, Atlassian $25.8M, SBI $20.2M, AEON $10.7M, TOPPAN $9.7M. Stripe: all 8,428 paying tenants, livemode, with 8,301 tenant IDs joined to Stripe accounts. NetSuite revenue ledgers for 584 named customers. AWS Marketplace: 861 buyer street addresses, 48,991 subscriber agreements. The China ledger: 12,262 revenue-recognition rows totalling ¥353.1M, with Bank of China, the Ministry of Science and Technology and China Life among the customers.
• **The source code.**413 repositories. The billing engine that trusts unverified X-ACCOUNT-USER-ID headers. The account service where admin is a tenant ID and impersonation bypasses org checks with owner role. The shared crypto library, pkgv2: AES-CBC with the IV derived from the key prefix — a static IV — instantiated with a single server-wide SaltSecret; every encrypted customer downstream-database password in the platform is one config secret from plaintext.
• **The identity graph.**13,620,173 GA4 device identifiers over 108,871,828 events; the cloud_users crosswalk (290,458 rows) that joins hashed user IDs to emails and employer tenant IDs; 2,895,030 rows linking logged-in identities to cookie trails; Mixpanel exports with 3,552 full named profiles; 24,932 personal emails with LinkedIn and GitHub profiles from the reo.dev developer-intelligence graph PingCAP purchased — Tencent’s 3,327 most active engineers, Huawei’s 2,726, ByteDance’s 2,475, ranked by their propensity to buy.

The Customers in the Records

The tenant IDs are not anonymous. PingCAP’s own ops audit trail maps them:

CustomerTenant ID / DetailBooking.comtenant 1372813089189081313Shopeetenant 1372813089191241283CAPCOM CO., LTDtenant 1372813089188871292, TiDB v6.1.1, ap-northeast-1Colopltenant 1326455380288475136, TiDB v6.1.0TOPPAN INC.prod-1372813089204501289, aws-ap-northeast-1Catalyst Softwareprod-1372813089188151289, aws-us-east-1SB Payment Serviceprod-1372813089206331321, aws-ap-northeast-1…plus, in the same 42-organisation table and the 94-entry billing dictionary that ships in the eda_service repository: Mercari, PayPay, Fujitsu, SoftBank, DMM, AEON, Square Enix, Konami, BANDAI NAMCO, Delhivery, Flipkart, Quincus, Nylas, Airbnb, Pinterest, Databricks, bitget, Pionex, DigiPlus, NFTscan, Baidu, SES-imagotag, Persona, Transsion, ZOZO, gumi, iret, Classmethod, Wetech, Atlassian, Cygames, SBI, LINE, Chainbase, PatSnap. Their VPC CIDRs are included; their cluster versions and endpoint hostnames are included; for the unlucky ones pasted into support tickets, so are their credentials.

The Warning Was Already in Jira

PingCAP’s security team wrote down exactly what was wrong with the multi-tenant isolation of their own product in 2022. SECURITY-22, from the internal security tracker, in their own words:

Summary: “The root password of the cluster can be reset unconditionally”

“All roles of the organization (including: owner, audit admin, billing admin, member) can unconditionally reset the root password of all clusters in the organization. This will cause all users in the organization to reset the cluster root password, and then users can connect to the cluster as root, modify the cluster state, and access cluster data.”

“Because the root account of the cluster has extremely high privileges, this will lead to a great security risk.”

Four years before we walked in, their own security team had documented that any member of a customer organisation — including a billing-only role — could take over every cluster in that organisation as root. The ticket is dated 2022-08. The breach ran through September 2026. A database company.

The ‘Support Operation’ as a Cross-Tenant Disclosure Engine

PingCAP’s engineers paste customers’ production credentials into Jira tickets. The three worst logs are included whole in the release (02_customer_credential_logs), and the tickets themselves are in 05_jira_issues:

GTOC-5812, 2023-02-01, in-ticket comment (LIVE at time of exfil):

AWS_ACCESS_KEY_ID=AKIAYM5Y2YXDRDJD2IOM
AWS_SECRET_ACCESS_KEY=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
aws s3 ls s3://pingcap-logs-pinterest/

APID-11182, attachment 81543_tidb-log.txt, posted 2025-05-02 by[email protected], inside a TiDB BR backup-config line (bucket:“cdx-crs-tidb-backup”):

AKIA2VMQLYWL3LJEHQFC : D7kJLJ2qIcdrjHrusWh5VTygW82hWN1ILirDosS7

ARN arn:aws:iam::733131556247:user/DEVOPS — AdministratorAccess + AmazonS3FullAccess over 258 buckets, including cdx-exp-npci-vault-snapshot, cdx-dev-npci-los-loandoc, cdx-dev-pci-sftp, cdx-sit-npci-lgc-smarttax-cloudhsm, cdx-dev-crs-silverlake-misc-binaries. None of these belonged to PingCAP.

APID-12036, a 314 MB customer production slow-query log attached to a support ticket (attachment 106965, in the release in full). The UPDATE statements contain the customer’s per-user credential store: 8,027 distinct values — 7,485 AWS STS session key sets scoped to per-user sandbox repositories, 345 GitHub user-to-server tokens, 192 AI-platform API keys across OpenAI, Anthropic, Gemini, ElevenLabs, xAI and OpenRouter, one AWS root key pair, one GitHub personal access token with 24 administrative scopes over 1,701 repositories (843 private) -- and this is only counting other companies’ credentials that arestill live. These customers are victims of PingCAP’s negligence; particularly the unfortunate companies whose GitHub admin and root AWS credentials were leaked by PingCAP. These two companies’ breaches are due entirely to their poor choice of cloud provider, and although we do feel for them, they will be hearing from us soon.

APID-11887, 1,825 distinct production connection strings with embedded username and password, one of which, verbatim:

mysql://3QqgLjKpGPJ9jgG.root:[email protected]:4000/6nyf9vDx56DJcbNfYFeWX6?ssl={"rejectUnauthorized":true}

TCID-2287:

mysql://redbulltest_replicated_tidb:[email protected]:3306/redbulltest_replicated_tidb.*

38 presigned S3 URLs into one customer’s own bucket, debank-temp.s3.ap-northeast-1.amazonaws.com, posted across 2024-01-25 → 2026-02-02 by the same support engineer.

Customers entrusted PingCAP with the credentials that connect their applications to the product. PingCAP’s tracker then distributed them to whoever holds this data.

The Margin, Per Customer

The ARR writer logs record every monthly write, per Salesforce account (07_arr_salesforce_logs):

write to salesforce success: {'Month_End_ARR_Amount__c': '2931005.0', 'Account__c': '0015g000002hX2QAAU', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'}

write to salesforce success: {'Month_End_ARR_Amount__c': '2100000.0', 'Account__c': '0015g000002hX2SAAU', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'}

write to salesforce success: {'Month_End_ARR_Amount__c': '1137016.2', 'Account__c': '001BV000003Ra97YAC', 'Revenue_Month__c': '2025-01-01', 'Product_Family__c': 'TiDB Enterprise Subscription'}

The Cygames contract is in the finance fixtures with its production numbers: tenant 1372813089191061283, order JP-OF-25030306, net fees $2,400,000, accumulated revenue $2,633,694.97. PatSnap (UK) Ltd’s monthly net fees: $136,093.25. FY25 company cloud quota: $29,438,510.37.

And in the China CRM, the sales-activity note reads:

中国人寿，是已经签了商务合同的客户。转移到大客户线索池。 (China Life — a customer with a signed commercial contract. Transferred to the enterprise lead pool.)

Customers in the Identity Graph

The cloud_users crosswalk joins the pseudonymous analytics layer to named people:

{"metadb_user_id": "6150003", "ga4_user_id": "a97cedec6bee3080548ba9209a65f2ab44c6a44e123bdbf84e44c9b832f1f894", "tenant_id": "1", "created_at": "2022-03-30 10:43:08 UTC", "updated_at": "2022-04-02 09:51:45 UTC", "user_email": "[email protected]", "user_email_domain": "pingcap.com", "user_status": "active", "user_first_name": "Sophie", "user_last_name": "Wang", "pseudo_users": [{}]}

Console page URLs carry tenant context:/clusters/10144798180725090481/sqleditor?orgId=1372813089209261904&projectId=1372813089454579595

The Mixpanel user.csv profile table:

[email protected] — Hong Kong, Happy Valley, last seen 2022-08-11
[email protected] — Milpitas, US
[email protected] — Osaka, last seen 2022-07-05

Top countries: Japan 774 · China 702 · India 499 · Hong Kong 416 · United States 342. Employers visible in the email domains: Klook, Colopl, Cygames, Booking.com, Mercari, Alibaba, Amazon.

The reo.dev graph they purchased ranks the developers of their target accounts by buying propensity, with business emails and LinkedIn profiles: Tencent 3,327 active developers, Huawei 2,726, ByteDance 2,475, AIG 2,140; 712 named high-intent buyers at Mastercard, Flipkart, bKash, Quark, Actian, eSewa.

Initial Release

Of the 10.6 TB we hold, the stage-one release is five tar.gz archives — 128.3 GB compressed, just over 200 GB uncompressed. More coming soon.

ArchiveSizeContentsDownload11_cur_tenant_costs.tar.gz70.6 GiBTenant-attributed AWS cost data, 2022–2026: 92 GB of month-partitioned parquet in which every line item carries resource_tags_user_tenant — the cost to serve every named customer, per cluster, per region, per component, against full savings-plan and reservation pricing — plus the 916,945-result Athena cost-analysis corpus (per-hour dedicated and serverless tier costs, NLB and cross-AZ transfer analyses)MAGNET|.torrent|ONION04_bigquery.tar.gz31.5 GiBThe complete BigQuery analytics estate, 83 datasets and 533.8M rows: the metadb control-plane mirror (23.6M rows), the sql_editor view, the cloud_users re-identification crosswalk, GA4 web analytics (108.9M events, 13.6M device identifiers), the salesforce, netsuite and hubspot ingestion datasets, the reo_dev developer-intelligence graph, and 401,911 raw sales-call transcript linesMAGNET|.torrent|ONION10_repos.tar.gz17.2 GiB413 private repositories with full git history across five GitHub organisations (tidbcloud, pingcap-inc, pingcap, tidb-incubator, Sibyl-TiDB): the billing engine, the account/identity service, the ops portal, the shared crypto library, the internal IT platform, and the SRE audit repositories that map customers to live tenant IDsMAGNET|.torrent|ONION09_gateway_logs.tar.gz6.9 GiBFour years of TiDB Cloud Data Gateway access logs — 23,651 daily files, 41 GB raw: 102,003,766 connections across 846,527 customer clusters, 1,443,915 SQL usernames, 5,036,738 unique client IPs, and the client software fingerprint of eachMAGNET|.torrentpingcap_leak_pack_rest.tar.gz2.1 GiBEight curated collections: 01_decoder_admissions (the SECURITY and HR trackers, production configs, cloudsql_secrets.json, the ops_trail customer→tenant decoder, the 94-name billing dictionary) • 02_customer_credential_logs (the three credential-bearing support logs: the vida BYOK store, the CardX administrator key, the CDC pipeline log) • 03_customer_book (HubSpot, Stripe, AWS Marketplace feeds, China CRM extracts, the Mixpanel identified-user table) • 05_jira_issues (all 377,446 issues across 57 projects) • 06_finance_snapshots (the df_finance and nexuscrm production snapshots of 2026-10-04, helix/pingkai/rd_group ingestions, finance-portal source and terraform state) • 07_arr_salesforce_logs (the monthly ARR writer logs) • 08_firewatch_chats (290 tenant-alert chat exports)MAGNET|.torrentpingcap-stage-one.torrent128.3 GiBAll five archives in one downloadMAGNET|.torrent Contact:[email protected]

plantegg (@plantegg): pingcap数据泄露还是被暴露出来了(破折号 后是我的点评)：

在 57 个月的统计周期内，PingCAP 的 AWS 总支出高达 $107,195,238.42 美元（约 1.07 亿美元）——就是pingcap购买AWS云服务器等然后部署tidb后卖给第三方客户使用

仅 us-east-1 区域的跨可用区传输费用（cross-AZ transfer）一项就高达