PingCAP (maker of TiDB) says an unauthorised party used stolen service-account credentials to access internal systems between 9 September and 7 October, copying source code and customer records including TiDB Cloud user names and emails, SQL editor text and billing details
PingCAP published a security incident report on 19 October 2026 saying that between 9 September and 7 October 2026 an unauthorised party used stolen service-account credentials to access certain PingCAP internal systems, copy data and obtain source code. PingCAP says it became aware on 7 October and began disabling the affected credentials that day, deleted further compromised credentials and removed excessive cross-project permissions by 10 October, and that as of 14 October all identified compromised credentials were invalidated and identified unauthorised access paths blocked. PingCAP says exported records included TiDB Cloud user names and email addresses, organisation and project associations, SQL editor text and errors, and some organisation, project and cluster identifiers, plus business and billing information (customer contacts, contract terms, orders, pricing, payment terms and billing configuration); it says this does not mean every customer had every category exposed and it is still establishing per-customer impact. It says an exported table contained encrypted TiDB Cloud API-key values and that one investigator-owned value tested by its external incident response firm could not be used directly as an API key, while whether other usable credentials were exposed is still being determined. PingCAP says the external firm found no evidence the attacker ran commands or kept persistent access in the production systems reviewed, and that with outside counsel and forensic specialists there is no evidence data stored in TiDB was impacted. It says the firm reported four vulnerabilities on 12 to 13 October, which PingCAP fixed by 14 October, and that it is checking production logs for earlier exploitation. PingCAP says it will notify affected customers directly. Source: PingCAP security incident report (19 Oct 2026).
- Product
- PingCAP internal systems and cloud resources; TiDB Cloud account and billing records; PingCAP source code
- Versions
- n/a — stolen service-account credentials; access 9 September to 7 October 2026
- Exploited in Australia?
- unknown
- Patch to
- TiDB Cloud customers: as a precaution, rotate TiDB Cloud API keys and any passwords, tokens or other secrets that were ever pasted into the SQL editor; review organisation members and cluster access; expect targeted phishing that uses contract, order or billing details. Questions go to security@pingcap.com (PingCAP). For your own estate: inventory service-account credentials, scope them to one project, and alert on large data exports.
Primary: PingCAP — Security Incident Report: Unauthorized Access to PingCAP Cloud Resources (19 Oct 2026) · Vendor: PingCAP Trust Hub — Security Update, October 2026