PingCAP Discloses TiDB Cloud Breach Exposing Customer Data

PingCAP has disclosed a security incident affecting TiDB Cloud, with intrusions occurring between 9 September and 7 October 2026. An attacker used stolen service account credentials to access internal PingCAP systems and copied customer records and source code over roughly four weeks. PingCAP identified the breach on 7 October and began disabling compromised accounts that day; by 14 October the security team had blocked all identified unauthorized access paths.

Investigators confirmed exposure of account metadata, billing details, and encrypted keys, while verifying whether any usable plain‑text credentials were accessed remains in progress.

The company states that not every customer necessarily faced the same exposure, and forensic specialists have said there is no evidence that data stored in TiDB was impacted.

TiDB Cloud users and enterprise customers are affected, but the vendor emphasises that “these findings do not mean that every customer had every category of information exposed.” In response, PingCAP hired an external incident‑response firm and outside legal counsel; four security flaws were identified between 12 and 13 October and patched by 14 October, with ongoing improvements to secret scanning, access controls, and cloud storage logging.

For affected customers, the guidance includes reviewing SQL editor history for sensitive queries or hardcoded secrets, rotating TiDB Cloud API keys, and monitoring billing contacts for targeted phishing.