In this article
  1. What happened
  2. Who’s affected
  3. What to do now
  4. What’s still unknown

TL;DR: PingCAP, the company behind the TiDB database and TiDB Cloud, says that between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to get into some of its internal systems, copy data and obtain source code. PingCAP says the copied records included TiDB Cloud user names and email addresses, SQL editor text and errors, customer contact and billing details, and a table of encrypted TiDB Cloud API-key values. It says it has found no evidence that data stored in TiDB was affected. PingCAP’s Japanese notice asks customers to check their access logs, review members and roles, watch for phishing emails that pose as PingCAP, and rotate their TiDB Cloud API keys. If you use TiDB Cloud, do those four things now.

What happened

PingCAP posted an incident report on its English Trust Hub, dated October 19, 2026, and a Japanese notice to customers in Japan. Both describe the same incident.

  • When and how: “Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code,” the English report says. The Japanese notice gives the same dates and says they are in US time. PingCAP says it became aware of the incident on October 7 and began disabling the affected credentials that day.
  • What was copied: the English report lists the customer data “identified as affected to date”:
    • TiDB Cloud accounts: “user names and email addresses, organization and project associations, and SQL editor text and errors,” with some records also containing organization, project and cluster identifiers.
    • Business and billing information: “customer contacts, contract terms, orders, pricing, payment terms, and billing configuration.” The Japanese notice says the contact details include names, email addresses, company names and phone numbers.
    • Credentials: “An exported table contained encrypted TiDB Cloud API-key values.” PingCAP says one value owned by the investigators, tested by the outside firm, “could not be used directly as an API key.”
  • In Japan: the Japanese notice says up to about 50,000 items of personal information in Japan were leaked. It also says that neither PingCAP nor the outside investigators found unauthorized access to TiDB Cloud itself or any leak of credit card information.
  • Your databases: the English report says an outside incident response firm reviewed PingCAP’s production systems and “found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed,” and that “there is no evidence that data stored in TiDB was impacted.” It adds that this finding “does not change the data exposure described below.”
  • What PingCAP has done: it says that by October 14 it had invalidated all the compromised credentials it identified and blocked the unauthorized access paths it found. The outside firm reported four vulnerabilities on October 12 and 13, and PingCAP says it fixed all four by October 14, with the firm confirming each fix. The Japanese notice adds that PingCAP rotated the keys found to have leaked and important keys it manages, and reported the incident to law enforcement and to regulators in the relevant countries.

Who’s affected

TiDB Cloud customers. PingCAP says “these findings do not mean that every customer had every category of information exposed” and that it is still working out the scope for each customer. It says it “will notify affected customers directly once we have established customer-specific impact.” Until then, it’s safest to assume your account and billing contacts may be in the copied records. Neither notice mentions self-managed TiDB.

What to do now

The English report doesn’t list customer steps. These four come from PingCAP’s Japanese notice (our translation):

  1. Check your access logs. PingCAP asks customers to review access logs for TiDB Cloud and related cloud accounts for access from suspicious IP addresses or operations they don’t recognize.
  2. Review members and roles. Check your TiDB Cloud organization’s members and roles, and remove accounts you don’t need or tighten access where needed.
  3. Watch for phishing. PingCAP warns that emails posing as PingCAP, or other suspicious emails about this incident, may arrive. It says it will never ask for passwords or access keys by email. If you get a suspicious email, don’t reply or click its links; contact PingCAP’s incident desk instead. The Japanese notice gives [email protected]; the English report gives [email protected] for questions.
  4. Rotate your TiDB Cloud API keys. PingCAP asks every customer who has issued TiDB Cloud API keys to rotate them. Our tip: create the new key, update the scripts, CI jobs and integrations that use it, then delete the old one.

Our own additions, beyond what PingCAP asks:

  • Check what you typed into the SQL editor. The copied records include SQL editor text and errors. If anyone on your team pasted a password, token or connection string into a query there, for example in a CREATE USER ... IDENTIFIED BY statement, change that secret too.
  • Expect targeted emails. The attacker may have names, email addresses, contract terms and pricing, so a fake invoice or “security notice” could look convincing. Check billing changes and payment requests through a channel you already trust, not through links in an email.

What’s still unknown

As of October 21, 11:18 a.m. Manila, PingCAP says it is still working out which customers and data types were affected, checking for any exploitation of the four vulnerabilities before they were fixed, and checking “whether any additional credentials were exposed.” It says “the attacker’s claims about credentials in support materials have not been verified.” The English report doesn’t say what source code was taken. The two notices also describe the API-key data differently: the English report says only that the values were encrypted and one tested value couldn’t be used directly as a key, while the Japanese notice says only the encrypted Public Key part leaked, not the Private Key part, so the leaked part alone can’t be used to operate TiDB Cloud. PingCAP still asks customers to rotate their keys. We’ll update this story when PingCAP publishes new findings. For another recent breach notice and what to check after one, see our story on the OpenCode Console security breach.

Sources & method

Sources

Method. Last checked October 21, 2026, at 11:18 a.m. Manila time (03:18 UTC). PingCAP’s English report shows it was last modified on October 21, 2026, at 9:09 a.m. Manila time (01:09 UTC); it doesn’t say what changed. The dates, the attack method, the data categories, the investigation findings and PingCAP’s actions come from PingCAP’s English report; the US-time note, the Japan figure, the credit card and API-key Private Key statements, and the four customer actions come from PingCAP’s Japanese notice, in our translation. We haven’t seen the copied data or verified PingCAP’s findings. The advice on SQL editor secrets and targeted emails is our own judgment. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.