2026 PingCAP — TiDB Cloud internal systems accessed with stolen service-account credentials; source code and customer billing data taken
Data compromised
TiDB Cloud account details (user names, email addresses, organisation and project links, SQL editor text and errors, cluster identifiers); business and billing records (customer contacts, contract terms, orders, pricing, payment terms, billing configuration); an exported table with encrypted TiDB Cloud API-key values; and source code. PingCAP says there is no evidence that data stored in TiDB was affected. No record counts are given.
Technical writeup
Verified PingCAP security report (Oct 19, 2026). Unauthorised access Sep 9 to Oct 7, 2026 with stolen service-account credentials. PingCAP began disabling credentials on Oct 7 and engaged an external incident-response firm; the firm reported four vulnerabilities on Oct 12–13, all fixed and retested by Oct 14. An external review found no evidence of commands run or persistent access in the production systems it examined, but PingCAP says that does not resolve the data exposure, and it is still checking logs for exploitation before the fixes. Customer-specific impact is still being determined; PingCAP will notify affected customers directly. Extortion group FulcrumSec has claimed 10.6 TB and 413 repositories; those claims are unverified and PingCAP has not confirmed them. The official report does not ask customers to rotate API keys. recordsAffected 0 (no count given).
Root cause
An unauthorised party used stolen service-account credentials to access certain PingCAP internal systems. Four vulnerabilities were found by an external firm and fixed by Oct 14. PingCAP has not stated how the credentials were stolen.