PingCAP Reports TiDB Cloud Breach Exposing Customer Records and Source Code
Summary
PingCAP says an intruder used stolen service-account credentials to access internal systems from Sept. 9 to Oct. 7, 2026, copying customer records and source code. Investigators found no impact to data stored in TiDB; access paths were blocked by Oct. 14.
Key points
- The unauthorized access began on Sept. 9, 2026, using stolen service-account credentials; PingCAP discovered it on Oct. 7.
- Copied information included names, email addresses, organization or cluster identifiers, SQL editor text, error logs, billing configurations, contract and pricing details, and encrypted API-key values.
- Investigators confirmed exposure of account metadata, billing details, and encrypted keys; whether usable plaintext credentials were accessed remains unverified.
- Forensic specialists found no evidence that data stored in TiDB databases was affected.
- PingCAP disabled compromised accounts, blocked identified unauthorized access paths by Oct. 14, and patched four identified security flaws, with investigators verifying the fixes.
- Customers were advised to review SQL editor history, rotate TiDB Cloud API keys, and watch for targeted phishing referencing contract or payment details.
Article Details
- Victim Organization
- PingCAP
- Incident Type
- Unauthorized access to internal systems using stolen service account credentials, followed by copying customer records and proprietary source code.
- Incident Date
- 2026-09-09
- Data Types Exposed
- User names
- Email addresses
- Organization or cluster identifiers
- SQL editor text
- Error logs
- Business billing configurations
- Contract terms
- Pricing details
- Encrypted API-key values
- Proprietary source code
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Internal PingCAP systems were accessed and data was copied. PingCAP began disabling compromised accounts on October 7, 2026, and blocked all identified unauthorized access paths by October 14. The article reports no evidence that data stored directly in TiDB was affected.
- Claim Status
- confirmed