PingCAP Reports Cloud Breach and Theft of Source Code

PingCAP, the company behind the distributed database TiDB, has published a report on a serious security incident. Between September 9 and October 7, 2026, an unknown party used stolen service-account credentials to break into the company's internal systems, copy some data, and obtain its source code. PingCAP became aware of the intrusion on October 7 and began disabling the compromised credentials the same day.

An external incident response firm reviewed the production systems and found no evidence that the attacker ran commands or maintained a foothold in the reviewed infrastructure. That finding, the company stresses, does not change the fact of the data exposure. Based on the investigation so far, data stored directly in TiDB appears not to have been affected. By October 14 all identified compromised credentials had been invalidated and the discovered unauthorized access paths blocked.

What was exposed

A review of the exported records revealed several categories of affected data. These included user names and email addresses, organization and project associations, and SQL editor text and errors from TiDB Cloud; some records also contained organization, project, and cluster identifiers. Business and billing information leaked separately: customer contacts, contract terms, orders, pricing, payment terms, and billing configuration.

Among the exported data was also a table of encrypted TiDB Cloud API-key values. One test key owned by the investigators themselves could not be used directly as a working credential. It remains unclear whether other usable keys were exposed; the attacker's claims about captured credentials have not been verified.

The company emphasizes that not every customer was necessarily affected across all categories — the individual scope of impact for each customer is still being determined.

Measures taken

Starting October 7, PingCAP began disabling affected accounts and keys; by October 10 it had deleted further compromised credentials and stripped excessive permissions between cloud projects. On October 12–13 the external specialists reported four vulnerabilities — all were fixed by October 14 and retested. Additional cloud storage access logging was also enabled.

The investigation continues: the company is checking logs for any earlier exploitation of the vulnerabilities, determining whether additional keys were exposed, and planning to strengthen credential rotation, access controls, code and secret scanning, and alerts for unusual activity and large data exports. Affected customers will be notified directly.

Source: Lobsters