I find it wild how much they have downplayed this in their statement. https://www.pingcap.com/trust-hub/security/security-update-o...

”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”

hmm, I don't think that's true.