New in Public Preview – PostgreSQL Support and TiDB Cloud Filesystem
Sign In Start for Free
Start for Free

Published: October 20, 2026

On October 19, we published a security incident report regarding unauthorized access to our cloud resources. While investigation into affected accounts continues, all customers are advised to take immediate preventive measures without waiting for direct notification.

The API-key values in the breached data were encrypted, and so far we have not found evidence that any were decrypted or used. Even so, there are two precautions worth taking now: replace your active TiDB Cloud management API keys, and be alert to targeted phishing. The key rotation steps below come from our engineering team.

At a Glance

We recommend two actions: replace your active management API keys, and treat unexpected requests with caution.

Action Who What to Do When
Replace active TiDB Cloud management API keys Organization owners Create replacement keys, update and verify dependent applications, then revoke the old keys Now, as a precaution
Revoke a key you suspect is misused Organization owners Revoke it immediately and contact security@pingcap.com Immediately
Be alert to targeted phishing Everyone on your team Verify unexpected requests through a trusted, previously established channel Ongoing

Replace Your Active TiDB Cloud Management API Keys

As a precaution, we recommend replacing active management API keys and revoking keys that are no longer needed.

Which path you take depends on whether you have seen signs of misuse:

  • No suspected misuse: create replacement keys, update and verify your dependent applications and automation, then promptly revoke the old keys.
  • Suspected misuse: revoke the key immediately and contact us, even if doing so temporarily interrupts an integration.

How to Rotate an API Key

Rotation takes three steps: create the new key, move your applications to it, then delete the old key. Only the owner of an organization can create or delete API keys. You can also follow the official API key documentation.

Step 1: Create a New API Key

  1. In the TiDB Cloud console, switch to your target organization using the combo box in the upper-left corner.
  2. In the left navigation pane, click Organization Settings > API Keys.
  3. On the API Keys page, click Create API Key.
  4. Enter a description for your API key.
  5. Configure the role and scope for the API key. For more information about the permissions of a role, see User roles.
  6. Click Generate API Key. Copy and save the public key and the private key.
  7. Make sure you have saved the private key in a secure location. The private key only displays when you create it. After you leave the page, you cannot get the full private key again.
  8. Click Done.

Step 2: Update and Verify Your Applications

Replace the old key with the new one in every application, script, and automation that uses it. Confirm that each one works with the new key before you move on.

Step 3: Delete the Old API Key

  1. In the TiDB Cloud console, switch to your target organization using the combo box in the upper-left corner.
  2. In the left navigation pane, click Organization Settings > API Keys.
  3. On the API Keys page, click … in the row of the API key you want to delete, and then click Delete.
  4. Click I understand, delete it.

Repeat these steps for each organization you own.

If You Suspect an API Key Is Being Misused

Revoke the API key right away using Step 3 above, then contact security@pingcap.com. Do not wait to create a replacement first. Please do not include passwords, tokens, private keys, or other secrets in your message.

You can also start reviewing now, without waiting for an individual impact notification. List every API key in each of your organizations under Organization Settings > API Keys, revoke any you no longer need, and review the logs available to you for activity you do not recognize.

Be Alert to Targeted Phishing

Treat unexpected requests involving passwords, verification codes, payment changes, or urgent account actions with caution, even if they include accurate information about your organization. Verify requests through a trusted, previously established channel.

We mention this because exported records included customer contacts and business and billing details, so a message can look credible. Three things are worth a pause:

  • A request to share a password or verification code
  • A request to change payment or billing details
  • A message that pushes you to take urgent action on your account

If you are unsure, do not reply to the message or use contact details inside it. Reach out through a channel you already trust.

What Happens Next

I know these steps take time and may affect your workflows. If you need help, contact security@pingcap.com. Please do not include passwords, tokens, private keys, or other secrets in your message.