La fuite de données de TiDB révèle des hypothèses de sécurité cloud défaillantes

PingCAP disclosed that attackers used stolen service-account credentials to access TiDB systems from September 9 to October 7, copying data and source code. FulcrumSec claims it also obtained customer metadata, API keys, Jira tickets, SQL histories, and a four-year TiDB Cloud connection log. Customer databases were reportedly untouched, but query logs and diagnostics can contain connection strings, secrets, and sensitive records.