https://www.pingcap.com/trust-hub/security/security-update-o...

I find it really baffling how much they are downplaying this incident on their statement.

”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”

That does not appear to be true.