Related ongoing thread:
replyPingCap TiDB Leaks - https://news.ycombinator.com/item?id=50173716 - Oct 2026 (32 comments)
(It had only spent 3 hours on the frontpage so I re-upped it.)
I guess I picked the wrong week to stop sniffing glue.
replyI find it wild how much they have downplayed this in their statement. https://www.pingcap.com/trust-hub/security/security-update-o...
reply”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”
hmm, I don't think that's true.
"Found no evidence" doesn't mean it didn't happen, it means the incident response firm didn't find it.
replyThe evidence is in the blog post explaining how they did it. However seeing at how bad their operations were I doubt they have evidence of anything themselves
replyPlaid is listed as a customer. Good times.
replyThat was a single company, the cert problem hit something like 70% of all websites and devices.
replyHonestly…I’ve never heard of pingcap
replyJesus that one is bad
reply > We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out. Eighty-eight consecutive exports, not one detection event.
Utterly humiliating.
reply