The extortion group FulcrumSec claims to have stolen 10.6 TB of data from TiDB Cloud, a managed database service provided by PingCAP. The group alleges the breach involves 4.9 million files and potentially affects over 180,000 organizations. FulcrumSec has released a 200 GB sample of the data, though the claims remain unverified as of October 20, 2026.
Bitget, one of the companies named by the group, stated that it previously used TiDB Cloud only for storing public trade logs. According to Xie Jiayin, head of Greater China operations, the exchange stopped using the service more than two months before the breach was announced. An internal review by the company found no evidence of sensitive user data or password exposure.
The exchange characterized the incident as a supply-chain issue rather than a direct breach of its own systems. Bitget confirmed that no customer assets or private information were compromised. However, the company advised its users to remain cautious regarding potential phishing attempts following the reports.
Other organizations reportedly listed by FulcrumSec as affected clients include the crypto trading platform Pionex and the technology company Baidu. The incident highlights the risks associated with managed database infrastructure, where a single compromise can impact numerous clients simultaneously.
