PingCAP says an attacker copied TiDB Cloud account and billing records, and asks customers to rotate API keys

PingCAP, the company behind the TiDB database and TiDB Cloud, has published an incident report saying that between 9 September and 7 October 2026 “an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code.” The page says it was published on 19 October and has been updated since.

What was taken, per PingCAP

PingCAP says it learned of the incident on 7 October and began disabling credentials that day. By 14 October, it says, all identified compromised credentials were invalidated and the identified access paths blocked. An outside firm reported four vulnerabilities on 12 and 13 October, which PingCAP says it fixed by 14 October.

According to the report, exported records included:

• TiDB Cloud accounts and usage: user names and email addresses, organization and project associations, SQL editor text and errors, and some organization, project and cluster identifiers.
• Business and billing: customer contacts, contract terms, orders, pricing, payment terms and billing configuration.
• Credentials: a table of encrypted TiDB Cloud API-key values. One investigator-owned value tested by the outside firm could not be used directly as an API key.

PingCAP says not every customer had every category exposed and that it is still working out who was affected. It says the outside firm found no evidence the attacker ran commands or kept persistent access in the production systems it reviewed, and that there is “no evidence that data stored in TiDB was impacted.” It is still checking production logs for exploitation of the four vulnerabilities before they were fixed.

What PingCAP asks customers to do

A customer actions page published 20 October asks everyone to act now rather than wait for a direct notice:

• Organization owners should create replacement TiDB Cloud management API keys, move every application and script to them, confirm they work, then delete the old keys. The page walks through Organization Settings > API Keys.
• If you suspect a key is being misused, revoke it immediately, even if that breaks an integration, and contact [email protected].
• Treat unexpected requests about passwords, verification codes, payment changes or urgent account actions with caution, “even if they include accurate information about your organization,” because contacts and billing details were in the exported data.

PingCAP says the API-key values were encrypted and that it has not found evidence any were decrypted or used. Claims about the breach posted elsewhere are the attacker’s, and PingCAP says those claims have not been verified.