Unauthorized Access to PingCAP Cloud Resources
5 points by eatonphil
5 points by eatonphil
I am just aghast at the fact that they appear to have set up a recurring ETL of all the data they stole, and claim it was on PingCAP's infra?
I'm imagining an Airflow job exfiltrating data on a schedule.
Imagine debugging a job that's failing but nobody knows what it's for, then realising that it's created by a hacker.
PingCAP's security team wrote down exactly what was wrong with the multi-tenant isolation of their own product in 2022. SECURITY-22, from the internal security tracker
That and support/engineers including plain text customer secrets in tickets. Ouch.