---
title: PingCAP confirms stolen service-account credentials let an intruder copy internal data, TiDB Cloud customer records and source code from Sep 9 to Oct 7 | ctxsec
url: https://ctxsec.com/items/pingcap-tidb-cloud-breach-sep-oct-2026
description: "PingCAP says an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code between Sep 9 and Oct 7, 2026. Exported records include TiDB Cloud user names and emails, billing and contract data, SQL editor text, and an encrypted API-key table. PingCAP found no impact to data stored in TiDB. The group FulcrumSec claims 10.6 TB; that figure is not verified."
status: "confirmed (PingCAP incident report, Oct 19); attacker's 10.6 TB claim unverified"
published: 2026-10-20
---

> PingCAP says an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code between Sep 9 and Oct 7, 2026. Exported records include TiDB Cloud user names and emails, billing and contract data, SQL editor text, and an encrypted API-key table. PingCAP found no impact to data stored in TiDB. The group FulcrumSec claims 10.6 TB; that figure is not verified.

[← Cybersecurity News](/news) · [markdown](/items/pingcap-tidb-cloud-breach-sep-oct-2026.md)

confirmed (PingCAP incident report, Oct 19); attacker's 10.6 TB claim unverified

2026-10-20

### PingCAP confirms stolen service-account credentials let an intruder copy internal data, TiDB Cloud customer records and source code from Sep 9 to Oct 7

PingCAP's [incident report](https://www.pingcap.com/trust-hub/security/security-update-october-2026/) (published Oct 19) says an unauthorized party used **stolen service account credentials** to access certain internal systems, copy data and obtain source code from **Sep 9 to Oct 7, 2026**. PingCAP learned of it on Oct 7, began disabling credentials that day, and says all identified compromised credentials were invalidated and access paths blocked by Oct 14. An external IR firm found no evidence the attacker ran commands or kept persistent access in the production systems it reviewed, and PingCAP says there is no evidence data stored in TiDB was impacted.

**Confirmed exposed data** (not every customer has every category): TiDB Cloud user names and email addresses, organization/project/cluster identifiers, SQL editor text and errors; customer contacts, contract terms, orders, pricing and billing configuration; and a table of **encrypted TiDB Cloud API-key values**. The external firm also reported four vulnerabilities on Oct 12–13 that PingCAP fixed by Oct 14. PingCAP's [Japanese notice](https://pingcap.co.jp/trust-hub/security/security-update-october-2026/) says up to about 50,000 personal records in Japan leaked, that only the encrypted public-key part of API keys was exposed, and that no credit card data was taken.

The extortion group FulcrumSec publicly claims it took about 10.6 TB, including plaintext credentials from support tickets; PingCAP says those credential claims have not been verified. Treat the volume figure as an attacker claim.

**Do now if you use TiDB Cloud:** rotate TiDB Cloud API keys, review org members and roles, check TiDB Cloud and linked cloud-account access logs for unfamiliar IPs or actions, rotate any secrets you ever pasted into PingCAP support tickets, and expect PingCAP-themed phishing (PingCAP says it never asks for passwords or keys by email).

Sources: [PingCAP: Security Incident Report, October 2026](https://www.pingcap.com/trust-hub/security/security-update-october-2026/) · [PingCAP Japan notice (ja)](https://pingcap.co.jp/trust-hub/security/security-update-october-2026/)