http://4e3p3in2bl67hxchuwza7qvnpe7pyeloyztr5fnh257fxkovfhappjyd.onion/pingcap/
10.6 TB total exfil • 4,901,203 files • 88 consecutive six-hourly exports of the production control plane, undetected • ~50 GCP storage buckets • a 533.8-million-row BigQuery warehouse • 180,046 tenant organisations • 403,262 unique emails • 115,308 plaintext customer API keys, 42,612 active • 20,645,574 customer SQL statements • 102,003,766 gateway connections • 5,036,738 customer server IPs • 377,446 Jira issues • 433,928 CRM contacts • 92 GB of tenant-tagged AWS cost data • 413 private source repos
This part might hurt:
PingCAP's security team wrote down exactly what was wrong with the multi-tenant isolation of their own product in 2022. SECURITY-22, from the internal security tracker, in their own words:
@neurovagrant oh this will be an interesting week