Unauthorized Access to PingCAP Cloud Resources

# Security Update – October 2026 Security Incident Report: Unauthorized Access to PingCAP Cloud Resources Source: [https://www.pingcap.com/trust-hub/security/security-update-october-2026/](https://www.pingcap.com/trust-hub/security/security-update-october-2026/) Published: October 19, 2026 ## Executive Summary Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code\. PingCAP became aware of the incident on October 7 and began disabling the affected credentials the same day\. An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed\. That finding does not change the data exposure described below\.**With support from outside counsel and third\-party forensic specialists, there is no evidence that data stored in TiDB was impacted\. We keep on investigating and will provide updates on any new findings\.**As of October 14, all identified compromised credentials have been invalidated, and the identified unauthorized access paths have been blocked\. The remaining investigation focuses on customer\-specific impact and possible exploitation before remediation\. ## What This Means for Customer Data Based on our investigation with an external incident response firm, including a review of the exported records, the categories below describe the customer data identified as affected to date\. These findings do not mean that every customer had every category of information exposed\. We are determining the scope for each customer\. InformationWhat the Investigation ConfirmedWhat Remains to Be DeterminedTiDB Cloud accounts and product useExported records included user names and email addresses, organization and project associations, and SQL editor text and errors\. Some records also contained organization, project, and cluster identifiers\.Particular customers’ records\.Business and billing informationExported records included customer contacts, contract terms, orders, pricing, payment terms, and billing configuration\.The individual customer impact scope is to be determined\. The findings do not mean every customer had every category of information exposed\.CredentialsAn exported table contained encrypted TiDB Cloud API\-key values\. One investigator\-owned value tested by the external firm could not be used directly as an API key\.Whether other usable credentials were exposed\. The attacker’s claims about credentials in support materials have not been verified\.Customer clustersInvestigators found no evidence that the attacker ran commands or maintained persistent access in the production systems they reviewed\.This finding does not resolve the data exposure above\. PingCAP is checking production logs for any exploitation of vulnerabilities before they were fixed\.## Actions Completed by October 14 ActionEvidence and OutcomeRestrict compromised accessBeginning October 7, PingCAP disabled or revoked most affected accounts and credentials\. By October 10, it had deleted additional compromised credentials and removed excessive permissions between cloud projects\. As of October 14, all identified unauthorized access paths have been blocked\.Fix identified vulnerabilitiesThe external firm reported four vulnerabilities on October 12 – 13\. PingCAP fixed all four by October 14, and the firm retested each fix and confirmed that all four vulnerabilities had been remediated\.Improve visibilityOn October 10, PingCAP enabled additional cloud storage access logging in an affected project to improve visibility into future activity\.## Work Continuing \(Status as of October 19\) PriorityStatus as of October 19Establish customer\-specific impactReview exported information to determine which customers and data types were affected\.Complete the security reviewCheck for earlier exploitation of the fixed vulnerabilities, determine whether any additional credentials were exposed, and assess remaining security findings\.Strengthen defensesExpand credential rotation, access controls, code and secret scanning, audit logging, and alerts for unusual access and large data exports\.## How We Will Keep You Informed We will notify affected customers directly once we have established customer\-specific impact\. For questions, contact[security@pingcap\.com](mailto:[email protected])\.