PingCAP (TiDB Cloud): Extortion group FulcrumSec used stolen service account credentials to access internal systems, copying business data and source code
Severity: high · Patch status: no-fix-needed · Since 2026-10-19
On Oct 19, 2026, PingCAP disclosed that extortion group FulcrumSec breached its internal systems between Sept 9 and Oct 7 using stolen service account credentials, copying data and source code. Forensics found no evidence attackers accessed customer TiDB databases or ran malicious commands, but exported records included TiDB Cloud account info, billing/contract details, email addresses, SQL editor text, encrypted API keys, and a four-year log of customer connections. FulcrumSec claims broader access (financial records, Google Cloud files, Jira, CRM, analytics) and named ~2,500+ affected organizations including Airbnb, Booking.com, Baidu, Fujitsu, Capcom, Konami, and Square Enix. PingCAP has invalidated compromised credentials, fixed four reported vulnerabilities, and advised API key rotation.
What to do
- Rotate TiDB Cloud management API keys immediately and audit for anomalous usage
- Be alert for targeted phishing using stolen billing/contract/contact data; brief staff and verify vendor communications out-of-band
- Review exposed account and usage data for sensitive contents and assess downstream compliance/notification obligations
- Monitor PingCAP's Trust Hub for customer-specific impact confirmations
- Harden service account credentials and access paths for cloud vendors holding business data
Sources
All live incidents on Threat Watch
