Regarding the unauthorized access to PingCAP, an independent investigation is said to have confirmed the existence of data including records equivalent to approximately 730,000 CRM records and Jira attachment records. It is not currently possible to determine whether the impact exceeded the number of leaked records disclosed by the Japanese entity, and verification is under way alongside a report by third-party investigation firm NebuSec.
Regarding the unauthorized access to PingCAP, which provides the distributed database “TiDB,” Security Measures Lab independently analyzed the possibility that the attackers obtained data including customer support materials, CRM data and Jira records. The affected CRM data comprised 734,614 CampaignMember rows, of which 717,127 had a non-NULL Email column. TiDB Cloud's Org__c contained 169,576 rows, of which 169,572 had a non-NULL Email value. These figures do not mean that all production data was leaked, and are said to be aggregate values based on metadata.
Jira data included 4,991 tickets and 29,502 attachment metadata records, and it was reported that numerous attachments existed, primarily in the APID project. Third-party investigation firm NebuSec confirmed that 6,458 tables had been exported in bulk from BigQuery and that customer-provided Jira credentials had been misused to access an S3 bucket. This information suggests routes by which the incident could extend to customers' diagnostic data and support materials, but a large-scale leak from the production database has not been confirmed.
No evidence has currently been confirmed of direct damage in addition to the number disclosed by the Japanese entity, namely a leak of approximately 50,000 records, the largest such incident in Japan. Although multiple names related to Japanese companies appeared in the independent investigation, the appearance of a company name or chat name does not itself mean that the entity was directly accessed without authorization or that personal information was leaked. Further verification is said to be necessary to identify the propagation routes. PingCAP has announced measures including credential rotation based on NebuSec's investigation findings.
Potential attack vectors cited include access originating from credentials obtained through support channels, exposure of information through publicly available SQL editor histories and errors, misuse of CRM and cloud organization information, and the acquisition of technical configuration and connection logs. How these factors may have affected Japanese companies must be verified individually. At present, direct intrusion into the production database or a large-scale leak of personal information has not been confirmed, and each company will need to determine whether notification or reporting is required if personal information is found to have been included.