PingCAP's incident report (published Oct 19) says an unauthorized party used stolen service account credentials to access certain internal systems, copy data and obtain source code from Sep 9 to Oct 7, 2026. PingCAP learned of it on Oct 7, began disabling credentials that day, and says all identified compromised credentials were invalidated and access paths blocked by Oct 14. An external IR firm found no evidence the attacker ran commands or kept persistent access in the production systems it reviewed, and PingCAP says there is no evidence data stored in TiDB was impacted.

Confirmed exposed data (not every customer has every category): TiDB Cloud user names and email addresses, organization/project/cluster identifiers, SQL editor text and errors; customer contacts, contract terms, orders, pricing and billing configuration; and a table of encrypted TiDB Cloud API-key values. The external firm also reported four vulnerabilities on Oct 12–13 that PingCAP fixed by Oct 14. PingCAP's Japanese notice says up to about 50,000 personal records in Japan leaked, that only the encrypted public-key part of API keys was exposed, and that no credit card data was taken.

The extortion group FulcrumSec publicly claims it took about 10.6 TB, including plaintext credentials from support tickets; PingCAP says those credential claims have not been verified. Treat the volume figure as an attacker claim.

Do now if you use TiDB Cloud: rotate TiDB Cloud API keys, review org members and roles, check TiDB Cloud and linked cloud-account access logs for unfamiliar IPs or actions, rotate any secrets you ever pasted into PingCAP support tickets, and expect PingCAP-themed phishing (PingCAP says it never asks for passwords or keys by email).