PingCAP reports that between 9 September and 7 October 2026 an unauthorized party used stolen service account credentials to access internal systems, copy data, and obtain source code; the company describes containment, customer impact, and hardening steps.
Security Update – October 2026: Unauthorized Access to PingCAP Cloud Resources
Published: October 19, 2026
Executive Summary
Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code. PingCAP became aware of the incident on October 7 and began disabling the affected credentials the same day.
An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed. That finding does not change the data exposure described below. With support from outside counsel and third-party forensic specialists, there is no evidence that data stored in TiDB was impacted. We keep on investigating and will provide updates on any new findings. As of October 14, all identified compromised credentials have been invalidated, and the identified unauthorized access paths have been blocked. The remaining investigation focuses on customer-specific impact and possible exploitation before remediation.
What This Means for Customer Data
Based on our investigation with an external incident response firm, including a review of the exported records, the categories below describe the customer data identified as affected to date. These findings do not mean that every customer had every category of information exposed. We are determining the scope for each customer.
Information
What the Investigation Confirmed
What Remains to Be Determined
TiDB Cloud accounts and product use
Exported records included user names and email addresses, organization and project associations, and SQL editor text and errors. Some records also contained organization, project, and cluster identifiers.
Particular customers’ records.
Business and billing information
Exported records included customer contacts, contract terms, orders, pricing, payment terms, and billing configuration.
The individual customer impact scope is to be determined. The findings do not mean every customer had every category of information exposed.
Credentials
An exported table contained encrypted TiDB Cloud API-key values. One investigator-owned value tested by the external firm could not be used directly as an API key.
Whether other usable credentials were exposed. The attacker’s claims about credentials in support materials have not been verified.
Customer clusters
Investigators found no evidence that the attacker ran commands or maintained persistent access in the production systems they reviewed.
This finding does not resolve the data exposure above. PingCAP is checking production logs for any exploitation of vulnerabilities before they were fixed.
Actions Completed by October 14
Action
Evidence and Outcome
Restrict compromised access
Beginning October 7, PingCAP disabled or revoked most affected accounts and credentials. By October 10, it had deleted additional compromised credentials and removed excessive permissions between cloud projects. As of October 14, all identified unauthorized access paths have been blocked.
Fix identified vulnerabilities
The external firm reported four vulnerabilities on October 12 – 13. PingCAP fixed all four by October 14, and the firm retested each fix and confirmed that all four vulnerabilities had been remediated.
Improve visibility
On October 10, PingCAP enabled additional cloud storage access logging in an affected project to improve visibility into future activity.
Work Continuing (Status as of October 19)
Priority
Status as of October 19
Establish customer-specific impact
Review exported information to determine which customers and data types were affected.
Complete the security review
Check for earlier exploitation of the fixed vulnerabilities, determine whether any additional credentials were exposed, and assess remaining security findings.
Strengthen defenses
Expand credential rotation, access controls, code and secret scanning, audit logging, and alerts for unusual access and large data exports.
How We Will Keep You Informed
We will notify affected customers directly once we have established customer-specific impact. For questions, contact security@pingcap.com.