In this guide
  1. What this checklist is for
  2. 1. Read the official notice and stay inside it
  3. 2. Follow the vendor’s steps, and no more than they support
  4. 3. Rotate exposed credentials
  5. 4. Watch for follow-on scams
  6. 5. Record what you did
  7. Related incidents on One Signal Desk

TL;DR: When a vendor reports unauthorized access to its systems, start with the official notice: what was taken, who is in scope, and what the vendor wants you to do. Follow those steps. Rotate credentials the vendor says were exposed, using the leaked secrets rotation checklist. If the vendor gives no cleanup steps, say so in your own notes and stay with what was actually published. Watch for phishing or shipping scams that quote real customer details.

What this checklist is for

This is a reusable customer-response checklist for a vendor or SaaS breach (account data, app identities, billing records, a website key). It is not a patch checklist; for an emergency product fix, use the emergency patch checklist. Broader alerts: security coverage.

1. Read the official notice and stay inside it

  1. Use the vendor’s own advisory, status page or emailed notice. Treat secondary posts as pointers, not as the source of who is affected or what was stolen.
  2. Write down, in the vendor’s words:
    • the window of exposure;
    • what records or identities were accessed or copied;
    • what the vendor says was not taken, if it says so;
    • the actions it asks customers to take;
    • any workaround, service suspension or restoration plan.
  3. Examples from our live coverage (re-read the article; status can change):
    • PingCAP said stolen service-account credentials let an intruder copy TiDB Cloud user names and emails, SQL editor text, contact and billing details, support-ticket information, and a table of encrypted API-key values, and that it had found no evidence that data stored in TiDB was affected. See our PingCAP article.
    • ConnectWise suspended Cloud Backup (formerly SkyKick) after “unauthorized access to application identities associated with ConnectWise Cloud Backup,” which stopped scheduled backups and restores. See our ConnectWise article for the restoration updates we recorded.
    • Keystone said an attacker took 25,964 Shopify buyer records, 12,873 unfinished checkouts, and the WebAuth key it uses to prove a device is genuine, and that recovery phrases and private keys were not involved. See our Keystone article.

2. Follow the vendor’s steps, and no more than they support

Do the items the vendor asked for, in their order.

  • PingCAP’s Japanese notice, as summarised in our article, asked customers to check access logs, review members and roles, watch for phishing emails that pose as PingCAP, and rotate TiDB Cloud API keys.
  • Keystone said that if a device reached you after October 20, you should contact Keystone support to verify it before you use it, and that you should not need to move your crypto if you follow its statement.
  • If the advisory gives no cleanup steps, record that. Our Zyxel GS1900 article notes that Zyxel’s advisory listed no workaround and no clean-up steps; in that case the work is the patch, not an invented forensics playbook.

Do not invent a “standard” wipe or a crypto-migration step the vendor did not publish.

3. Rotate exposed credentials

If the notice says keys, tokens, app identities or environment variables were involved, inventory and rotate them with the leaked secrets rotation checklist: create new credentials, deploy, revoke the old ones, then review logs.

ConnectWise said it had finished resetting accounts and credentials as part of its response; still follow whatever it asks customers to do in the latest official update, which may include reconnecting integrations after a suspension.

4. Watch for follow-on scams

A stolen customer list is often used for targeted messages that quote a real order, ticket or billing detail.

  • Keystone told buyers to expect targeted scam messages that quote a real order, and to verify a device that arrived after the breach window with support first.
  • PingCAP asked customers to watch for phishing that poses as PingCAP.

Confirm unexpected requests out of band, through a contact path you already had, not through a link in the suspicious message.

5. Record what you did

Keep a short internal note: the notice you relied on, the date you read it, the accounts you rotated, and any vendor case or ticket ID. That is for your own follow-up, not a substitute for the vendor’s investigation.

Sources

Last checked: Nov 10, 2026, 1:16 p.m. Manila (UTC+8). Method: We built this type-level checklist from the live One Signal Desk articles linked above (HTTP 200 on Nov 10) and from the vendor steps those articles already quote. Restoration and “what was taken” lines can move; re-read the official notice and our article before you act. Thumbnail is a reuse-licensed image, credited with its license under the picture. No HowTo or FAQ schema. No affiliate links. How we work.