Short answer
PingCAP says an unauthorized party used stolen service account credentials between 9 September and 7 October 2026 to copy internal data and source code. It says it found no evidence that data stored in TiDB was affected. An extortion group has made much larger claims that are unverified.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | PingCAP (TiDB Cloud) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Database software and cloud services |
| Country | United States |
| Detected | 2026-10-07 |
| Disclosed | 2026-10-19 |
| People or records affected | Not stated. PingCAP says scope varies by customer and is still being determined |
What data was exposed
- TiDB Cloud user names, email addresses, organization and project associations, and SQL editor text and errors
- Customer contacts, contract terms, orders, pricing and billing configuration
- An exported table of encrypted TiDB Cloud API-key values (the encryption key was not exposed)
- Internal source code and support tickets, some of which contained credentials customers had shared
What happened
PingCAP, the company behind the TiDB database and its TiDB Cloud service, published a security update on 19 October 2026. It says an unauthorized party used stolen service account credentials from 9 September to 7 October to access internal systems, copy data and obtain source code. PingCAP became aware on 7 October and began disabling the affected credentials, and by 14 October all identified compromised credentials were invalidated.
InfoQ reported the case on 25 October.
What was copied
PingCAP lists TiDB Cloud account and product-use data (names, emails, organization and project links, SQL editor text and errors), business and billing records, and an exported table of encrypted API-key values. It says one investigator-owned value it tested could not be used directly as an API key, and that whether other usable credentials were exposed is still being determined.
The CEO note says the investigator, NebuSec, found no evidence that data in customers’ TiDB databases was accessed. NebuSec’s write-up describes eight compromised Google Cloud service accounts and 6,458 BigQuery tables exported to cloud storage, and says credentials customers placed in support tickets, including AWS keys, opened access to storage buckets holding one customer’s diagnostic data.
Attacker claims
Per InfoQ, the extortion group FulcrumSec claims to have taken 10.6 TB, including 413 private repositories, records for about 180,000 tenant organizations, and more than 40,000 active API keypairs. It released a 128.3 GB sample. These are the group’s claims. InfoQ says they have not been independently verified, and PingCAP’s report does not confirm them. Naming a company in the leaked data does not show it was compromised.
What to do
PingCAP’s CEO note asks customers to replace TiDB Cloud management API keys, rotate anything shared with support, and watch for targeted phishing. Because the exposed data includes contract and billing details, phishing could look very convincing.
See our data breach checklist, the guide to fake invoice and business email scams and the one on phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Targeted phishing that uses real project names, contract details or support history to look like PingCAP or TiDB Cloud.
- Fake invoices or payment-term changes citing genuine order or billing details.
- Misuse of any credentials you shared in a support ticket to reach your cloud accounts or databases.
What to do if you are affected
- 01Replace your active TiDB Cloud management API keys.
- 02Rotate anything you shared with PingCAP support, including credentials, keys, connection strings and logs containing secrets.
- 03Verify any request about passwords, verification codes or payment changes through a channel you already trust.
- 04Contact PingCAP at security@pingcap.com for an assessment of your organization, without including secrets in the message.
- 05Review your cloud audit logs for activity you do not recognize, especially on accounts whose keys you shared with support.
Frequently asked questions
Was customer data inside TiDB databases accessed?
PingCAP says there is no evidence that data stored in TiDB was impacted, and an outside firm found no evidence of attacker command execution or persistence in the production systems reviewed. PingCAP is still checking logs.
How did the attacker get in?
PingCAP's report says stolen service account credentials. The investigator NebuSec, which PingCAP hired, describes a chain that began with a compromised GitHub account and eight compromised Google Cloud service accounts.
What has the extortion group claimed?
InfoQ reports that a group called FulcrumSec claims 10.6 TB of stolen data, including about 180,000 tenant organizations and 115,000 API keypairs. These claims are unverified, and PingCAP has not confirmed those figures.
How many customers are affected?
PingCAP gives no number. It says its findings do not mean every customer had every category of information exposed, and it will notify affected customers directly.
Sources
- Security update, October 2026, PingCAP, 2026-10-19
- PingCAP breach: cloud data and source code exposed, InfoQ, 2026-10-25
- A note from our CEO on the PingCAP security incident, PingCAP, 2026-10-23
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.