{"id":35522,"date":"2026-10-23T11:17:59","date_gmt":"2026-10-23T18:17:59","guid":{"rendered":"https:\/\/www.pingcap.com\/?page_id=35522"},"modified":"2026-10-23T11:59:52","modified_gmt":"2026-10-23T18:59:52","slug":"ceo-note-october-2026","status":"publish","type":"page","link":"https:\/\/www.pingcap.com\/ko\/trust-hub\/security\/ceo-note-october-2026\/","title":{"rendered":"A Note from Our CEO on Our Security Incident"},"content":{"rendered":"","protected":false},"excerpt":{"rendered":"","protected":false},"author":305,"featured_media":0,"parent":23139,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"class_list":["post-35522","page","type-page","status-publish","hentry"],"acf":[],"featured_image_src":null,"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>A Note from Our CEO on Our Security Incident | TiDB<\/title>\n<meta name=\"description\" content=\"PingCAP powers your digital transformation with a single source of truth at scale. Developed to be an open, unified, distributed SQL database solution. Learn more on A Note from Our CEO on Our Security Incident page.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pingcap.com\/ko\/trust-hub\/security\/ceo-note-october-2026\/\" \/>\n<meta property=\"og:locale\" content=\"ko_KR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Note from Our CEO on Our Security Incident | TiDB\" \/>\n<meta property=\"og:description\" content=\"PingCAP powers your digital transformation with a single source of truth at scale. Developed to be an open, unified, distributed SQL database solution. Learn more on A Note from Our CEO on Our Security Incident page.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pingcap.com\/ko\/trust-hub\/security\/ceo-note-october-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"TiDB\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/pingcap2015\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-23T18:59:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/static.pingcap.com\/files\/2024\/09\/11005522\/Homepage-Ad.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1440\" \/>\n\t<meta property=\"og:image:height\" content=\"714\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@PingCAP\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/security\\\/ceo-note-october-2026\\\/\",\"url\":\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/security\\\/ceo-note-october-2026\\\/\",\"name\":\"A Note from Our CEO on Our Security Incident | TiDB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/#website\"},\"datePublished\":\"2026-10-23T18:17:59+00:00\",\"dateModified\":\"2026-10-23T18:59:52+00:00\",\"description\":\"PingCAP powers your digital transformation with a single source of truth at scale. Developed to be an open, unified, distributed SQL database solution. Learn more on A Note from Our CEO on Our Security Incident page.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/security\\\/ceo-note-october-2026\\\/#breadcrumb\"},\"inLanguage\":\"ko-KR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/security\\\/ceo-note-october-2026\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/security\\\/ceo-note-october-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pingcap.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trust Hub\",\"item\":\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.pingcap.com\\\/trust-hub\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"A Note from Our CEO on Our Security Incident\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/#website\",\"url\":\"https:\\\/\\\/www.pingcap.com\\\/\",\"name\":\"TiDB\",\"description\":\"TiDB | SQL at Scale\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pingcap.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ko-KR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/#organization\",\"name\":\"PingCAP\",\"url\":\"https:\\\/\\\/www.pingcap.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ko-KR\",\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/static.pingcap.com\\\/files\\\/2021\\\/11\\\/pingcap-logo.png\",\"contentUrl\":\"https:\\\/\\\/static.pingcap.com\\\/files\\\/2021\\\/11\\\/pingcap-logo.png\",\"width\":811,\"height\":232,\"caption\":\"PingCAP\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pingcap.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/facebook.com\\\/pingcap2015\",\"https:\\\/\\\/x.com\\\/PingCAP\",\"https:\\\/\\\/linkedin.com\\\/company\\\/pingcap\",\"https:\\\/\\\/youtube.com\\\/channel\\\/UCuq4puT32DzHKT5rU1IZpIA\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A Note from Our CEO on Our Security Incident | TiDB","description":"PingCAP powers your digital transformation with a single source of truth at scale. Developed to be an open, unified, distributed SQL database solution. Learn more on A Note from Our CEO on Our Security Incident page.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pingcap.com\/ko\/trust-hub\/security\/ceo-note-october-2026\/","og_locale":"ko_KR","og_type":"article","og_title":"A Note from Our CEO on Our Security Incident | TiDB","og_description":"PingCAP powers your digital transformation with a single source of truth at scale. Developed to be an open, unified, distributed SQL database solution. Learn more on A Note from Our CEO on Our Security Incident page.","og_url":"https:\/\/www.pingcap.com\/ko\/trust-hub\/security\/ceo-note-october-2026\/","og_site_name":"TiDB","article_publisher":"https:\/\/facebook.com\/pingcap2015","article_modified_time":"2026-10-23T18:59:52+00:00","og_image":[{"width":1440,"height":714,"url":"https:\/\/static.pingcap.com\/files\/2024\/09\/11005522\/Homepage-Ad.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_site":"@PingCAP","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.pingcap.com\/trust-hub\/security\/ceo-note-october-2026\/","url":"https:\/\/www.pingcap.com\/trust-hub\/security\/ceo-note-october-2026\/","name":"A Note from Our CEO on Our Security Incident | TiDB","isPartOf":{"@id":"https:\/\/www.pingcap.com\/#website"},"datePublished":"2026-10-23T18:17:59+00:00","dateModified":"2026-10-23T18:59:52+00:00","description":"PingCAP powers your digital transformation with a single source of truth at scale. Developed to be an open, unified, distributed SQL database solution. Learn more on A Note from Our CEO on Our Security Incident page.","breadcrumb":{"@id":"https:\/\/www.pingcap.com\/trust-hub\/security\/ceo-note-october-2026\/#breadcrumb"},"inLanguage":"ko-KR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pingcap.com\/trust-hub\/security\/ceo-note-october-2026\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.pingcap.com\/trust-hub\/security\/ceo-note-october-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pingcap.com\/"},{"@type":"ListItem","position":2,"name":"Trust Hub","item":"https:\/\/www.pingcap.com\/trust-hub\/"},{"@type":"ListItem","position":3,"name":"Security","item":"https:\/\/www.pingcap.com\/trust-hub\/security\/"},{"@type":"ListItem","position":4,"name":"A Note from Our CEO on Our Security Incident"}]},{"@type":"WebSite","@id":"https:\/\/www.pingcap.com\/#website","url":"https:\/\/www.pingcap.com\/","name":"\ud2f0DB","description":"TiDB | SQL at Scale","publisher":{"@id":"https:\/\/www.pingcap.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pingcap.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ko-KR"},{"@type":"Organization","@id":"https:\/\/www.pingcap.com\/#organization","name":"PingCAP","url":"https:\/\/www.pingcap.com\/","logo":{"@type":"ImageObject","inLanguage":"ko-KR","@id":"https:\/\/www.pingcap.com\/#\/schema\/logo\/image\/","url":"https:\/\/static.pingcap.com\/files\/2021\/11\/pingcap-logo.png","contentUrl":"https:\/\/static.pingcap.com\/files\/2021\/11\/pingcap-logo.png","width":811,"height":232,"caption":"PingCAP"},"image":{"@id":"https:\/\/www.pingcap.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/pingcap2015","https:\/\/x.com\/PingCAP","https:\/\/linkedin.com\/company\/pingcap","https:\/\/youtube.com\/channel\/UCuq4puT32DzHKT5rU1IZpIA"]}]}},"grav_blocks":[{"acf_fc_layout":"columns","format":"","enable_box_container":false,"column_num":"10","columns":[{"type":"wysiwyg","wysiwyg":"<p><!-- Page title (WordPress title field): A Note from Our CEO on Our Security Incident --><br \/>\n<!-- Suggested URL: \/trust-hub\/security\/ceo-note-october-2026\/ --><\/p>\n<p style=\"margin:0 0 24px 0;font-size:14px;font-weight:700;opacity:0.75;\">Max Liu, Co-founder and CEO, PingCAP | Published: October 23, 2026<\/p>\n<p>As part of our commitment to transparency, I want to provide our customers and partners with a direct update on a recent security incident affecting our PingCAP systems.<\/p>\n<p>Between September 9 and October 7, 2026, an unauthorized party used compromised credentials to access PingCAP\u2019s internal systems and copy information from them, including information our customers entrusted to us.<\/p>\n<p>We did not protect that information as we should have. I\u2019m sorry for the exposure itself, for the work it has created for your teams, and for the concern it has caused the people whose information was involved. This happened on my watch. I take responsibility for it, and for fixing it.<\/p>\n<h2 style=\"margin:40px 0 0 0;padding-bottom:16px;\">What the Independent Investigation Found<\/h2>\n<p style=\"margin:0 0 16px 0;\">We take this incident seriously and engaged with multiple cybersecurity firms to conduct independent investigations. NebuSec has completed its investigation and <a href=\"https:\/\/nebusec.ai\/research\/pingcap-security-incident\/\">published its findings here<\/a>. In short:<\/p>\n<ul style=\"margin:0 0 24px 0;\">\n<li>Between September 9 and October 7, 2026, an attacker used a compromised GitHub account and exposed credentials to access PingCAP\u2019s internal systems, obtain source code, and copy records from internal analytics, storage, and support environments.<\/li>\n<li>NebuSec found no evidence that data stored in customers\u2019 TiDB databases was accessed, and no evidence of attacker persistence in our production environment.<\/li>\n<li>Customer-related information was copied from internal analytics, storage and support systems. NebuSec\u2019s report lists each category of data and where it came from.<\/li>\n<li>TiDB Cloud API-key values in the exported data were encrypted, and the encryption key was not exposed. This does not apply to credentials that were shared in support materials.<\/li>\n<li>All identified compromised credentials were invalidated, and the vulnerabilities NebuSec found during its review were fixed and retested, with no evidence they had been exploited.<\/li>\n<\/ul>\n<p>The scope and types of data exposure described in NebuSec\u2019s report vary by customer. Please contact the PingCAP team for an assessment of the impact on your organization.<\/p>\n<h2 style=\"margin:40px 0 0 0;padding-bottom:16px;\">What to Do Now<\/h2>\n<ul style=\"margin:0 0 24px 0;\">\n<li><strong>Replace your TiDB Cloud management API keys<\/strong>, following the steps in our <a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/customer-actions-october-2026\/\">customer actions page<\/a>.<\/li>\n<li><strong>Rotate anything you have shared with PingCAP support<\/strong> \u2014 credentials, keys, connection strings, or logs containing secrets.<\/li>\n<li><strong>Be alert to targeted phishing.<\/strong> Verify any request involving passwords, verification codes or payment changes through a channel you already trust.<\/li>\n<\/ul>\n<p>We are determining customer-specific impact and will contact affected customers directly. Please follow these steps now rather than waiting for an individual notice.<\/p>\n<h2 style=\"margin:40px 0 0 0;padding-bottom:16px;\">What Changes<\/h2>\n<p>Internal systems that hold customer information must meet the same security standard as production. Every credential must have an owner and only the access it needs. Unusual access and large data movements must be detected and acted on. NebuSec\u2019s report describes the containment and hardening work completed so far, and that work continues.<\/p>\n<p>If you have questions, contact our security team at <a href=\"mailto:security@pingcap.com\">security@pingcap.com<\/a>. Please do not include passwords, tokens, keys or other secrets. Our <a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\">incident report<\/a> remains the reference for this incident.<\/p>\n<p>Max Liu<br \/>Co-founder and CEO, PingCAP<\/p>\n","accordion_column_title":"","accordion_sections":false,"accordion_enable_faq_schema":false,"video_image":false,"video_url":"","video_content":""}],"block_background":"block-bg-none","block_background_video_type":"url","block_background_video_url":"","block_background_video_file":false,"block_background_image":false,"block_background_overlay":false,"unique_id":"","block_option_custom_class":"","block_option_padding":[],"block_option_hide":[],"block_add_top_arc":false,"block_increase_bottom_padding":false}],"_links":{"self":[{"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/pages\/35522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/users\/305"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/comments?post=35522"}],"version-history":[{"count":5,"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/pages\/35522\/revisions"}],"predecessor-version":[{"id":35543,"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/pages\/35522\/revisions\/35543"}],"up":[{"embeddable":true,"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/pages\/23139"}],"wp:attachment":[{"href":"https:\/\/www.pingcap.com\/ko\/wp-json\/wp\/v2\/media?parent=35522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}