Security Incident Report:
Unauthorized Access to PingCAP Cloud Resources

Executive Summary

Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code. PingCAP became aware of the incident on October 7 and began disabling the affected credentials the same day.

An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed. That finding does not change the data exposure described below. With support from outside counsel and third-party forensic specialists, there is no evidence that data stored in TiDB was impacted. We keep on investigating and will provide updates on any new findings. As of October 14, all identified compromised credentials have been invalidated, and the identified unauthorized access paths have been blocked. The remaining investigation focuses on customer-specific impact and possible exploitation before remediation.

What This Means for Customer Data

Based on our investigation with an external incident response firm, including a review of the exported records, the categories below describe the customer data identified as affected to date. These findings do not mean that every customer had every category of information exposed. We are determining the scope for each customer.

Information	What the Investigation Confirmed	What Remains to Be Determined
TiDB Cloud accounts and product use	Exported records included user names and email addresses, organization and project associations, and SQL editor text and errors. Some records also contained organization, project, and cluster identifiers.	Particular customers’ records.
Business and billing information	Exported records included customer contacts, contract terms, orders, pricing, payment terms, and billing configuration.	The individual customer impact scope is to be determined. The findings do not mean every customer had every category of information exposed.
Credentials	An exported table contained encrypted TiDB Cloud API-key values. One investigator-owned value tested by the external firm could not be used directly as an API key.	Whether other usable credentials were exposed. The attacker’s claims about credentials in support materials have not been verified.
Customer clusters	Investigators found no evidence that the attacker ran commands or maintained persistent access in the production systems they reviewed.	This finding does not resolve the data exposure above. PingCAP is checking production logs for any exploitation of vulnerabilities before they were fixed.

Actions Completed by October 14

Action	Evidence and Outcome
Restrict compromised access	Beginning October 7, PingCAP disabled or revoked most affected accounts and credentials. By October 10, it had deleted additional compromised credentials and removed excessive permissions between cloud projects. As of October 14, all identified unauthorized access paths have been blocked.
Fix identified vulnerabilities	The external firm reported four vulnerabilities on October 12 – 13. PingCAP fixed all four by October 14, and the firm retested each fix and confirmed that all four vulnerabilities had been remediated.
Improve visibility	On October 10, PingCAP enabled additional cloud storage access logging in an affected project to improve visibility into future activity.

Work Continuing (Status as of October 19)

Priority	Status as of October 19
Establish customer-specific impact	Review exported information to determine which customers and data types were affected.
Complete the security review	Check for earlier exploitation of the fixed vulnerabilities, determine whether any additional credentials were exposed, and assess remaining security findings.
Strengthen defenses	Expand credential rotation, access controls, code and secret scanning, audit logging, and alerts for unusual access and large data exports.

How We Will Keep You Informed

We will notify affected customers directly once we have established customer-specific impact. For questions, contact security@pingcap.com.