TiDB Cloud Maker PingCAP Confirms Month-Long Breach: What Was Taken and What Customers Should Do

PingCAP, the company behind the TiDB database and its TiDB Cloud service, has disclosed a security incident involving unauthorised access to internal systems over nearly a month.

In a security report published on October 19, 2026, the company said an outside party used stolen service account credentials to access certain internal resources between September 9 and October 7. The attacker copied information and obtained source code before PingCAP detected the incident and began disabling affected credentials.

The disclosure raises concerns about customer information, internal business records and the security of credentials used to manage cloud services. PingCAP has continued investigating the incident and determining which customers were affected. Its updates are available through the company’s security incident report.

What Information Was Exposed?

PingCAP’s investigation identified several categories of information in exported records. However, the company has stressed that the findings do not mean every customer had every type of information exposed.

The affected categories included:

• Account and product information: User names, email addresses, organisation and project associations, SQL editor text, errors and some organisation, project and cluster identifiers.
• Business and billing records: Customer contacts, contract terms, orders, pricing, payment terms and billing configuration.
• API-key information: An exported table contained encrypted TiDB Cloud API-key values.

An external investigation tested one key value belonging to the investigator and found that it could not be used directly as an API key. PingCAP has not ruled out the possibility that other usable credentials were exposed, and the investigation into the full scope of the incident has continued.

The company also obtained information about source code and internal systems. The exposure of business and technical records is significant because such information can help attackers create convincing phishing messages targeting specific organisations.

Did the Attacker Access Customer Databases?

PingCAP said that its investigation, conducted with external incident-response specialists and forensic support, found no evidence that data stored in TiDB customer databases had been affected.

Investigators also found no evidence that the attacker executed commands or maintained persistent access in the production systems they reviewed.

These findings are important, but they do not mean that no information was exposed. The confirmed export of internal records and source code remains a security concern, and PingCAP has continued checking for possible earlier exploitation of vulnerabilities.

How PingCAP Responded to the Breach

The company began disabling affected credentials on October 7. By October 10, it had removed additional compromised credentials, reduced excessive permissions between cloud projects and enabled extra storage-access logging.

An external security firm reported four vulnerabilities on October 12 and 13. PingCAP said it fixed all four by October 14 and that the firm retested the fixes.

As of October 14, the company said all identified compromised credentials had been invalidated and known unauthorised access paths had been blocked. Further work has focused on identifying affected customers, reviewing earlier activity and strengthening credential rotation, secret scanning and alerts for unusually large data exports.

PingCAP has said it will contact affected customers directly.

What TiDB Cloud Customers Should Do Now

PingCAP’s October 20 customer guidance recommends that all customers replace their active TiDB Cloud management API keys as a precaution, even if they have not received an individual notification.

Customers should create replacement keys, update dependent applications, verify that the applications work and then revoke the old keys. Any key suspected of misuse should be revoked immediately.

Organisations should also watch for targeted phishing messages referencing their project names, contacts, contracts or pricing. If SQL editor text contained sensitive information, they should review the possible implications and take appropriate action.

Questions about the incident can be directed to [email protected].

The incident highlights the importance of strong access controls, regular credential rotation, careful handling of internal records and prompt security monitoring for cloud service providers.