Skip to contentistheinternetok
All incidents

Data breach·Major

PingCAP / TiDB Cloud: internal systems breached

MitigatedAttackers already use itAffects developers
TiDB Cloud

What it changes for you

Nothing visible for you; only TiDB Cloud customers are concerned.

An intruder used stolen credentials to get into PingCAP's internal systems for about a month and copied account data, billing records and source code. It matters only if your company uses the TiDB Cloud database service.

Started Sep 9, 2026Updated Oct 19, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
If you use TiDB Cloud, watch for PingCAP's direct notice about your account, review and rotate TiDB Cloud API keys, and check for unexpected activity. Questions go to security@pingcap.com.

What is affected

Timeline

  1. Mitigated · Oct 19, 2026

    PingCAP publishes its report: account and usage data, business and billing data, an export containing encrypted API-key values, and source code were obtained. No evidence that data stored in TiDB was impacted; investigation ongoing.

    PingCAP

  2. Mitigated · Oct 14, 2026

    PingCAP fixes four vulnerabilities reported by an external firm and blocks all identified unauthorized access paths.

    PingCAP

  3. Identified · Oct 7, 2026

    PingCAP learns that stolen service account credentials were used to access internal systems since September 9, and starts disabling them.

    PingCAP

Sources