Security notice
App or store data on TiDB Cloud? PingCAP was breached. Replace your keys today.
On October 19, 2026, PingCAP, the company behind the TiDB Cloud database service, disclosed that between September 9 and October 7 an unauthorized party used stolen credentials to get into its internal systems, copy data and obtain source code. PingCAP says the copied records include TiDB Cloud account details, customer contacts, contracts and billing information, text typed into its SQL editor and encrypted API-key values. Its investigators also say the attacker took passwords and keys that customers had shared with PingCAP support. PingCAP says it has found no evidence that data stored in customers' TiDB databases was accessed. It asks every customer to replace their TiDB Cloud management API keys now, as a precaution, without waiting to be contacted. If your website, store or app keeps its data in TiDB Cloud, have your developer do this today.
What happened
- The break-in. PingCAP says that between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access some of its internal systems, copy data and obtain source code. It found out on October 7 and began disabling the credentials that day. As of October 14, it says all identified stolen credentials were cancelled and the identified ways in were blocked. (PingCAP)
- How the attacker got in. NebuSec, the security firm PingCAP hired to investigate, says the attacker first got in through a compromised GitHub account, then used keys and tokens found in PingCAP's code repositories to reach its Google Cloud, Jira and internal chat systems. (NebuSec, PingCAP CEO note)
- What was copied. PingCAP lists user names and email addresses, organization and project details, SQL editor text and errors, and some cluster identifiers. It also lists customer contacts, contract terms, orders, pricing, payment terms and billing setup, plus a table of encrypted TiDB Cloud API-key values. PingCAP says not every customer had every type of information exposed, and it is still working out which customers were affected. (PingCAP)
- Secrets shared with support were taken. NebuSec says the attacker collected credentials that customers had shared in support tickets, including Amazon cloud (AWS) keys, and used them to reach storage holding customers' TiDB diagnostic data. PingCAP's CEO tells customers to change anything they shared with PingCAP support. (NebuSec, PingCAP CEO note)
- Customer databases. PingCAP says there is "no evidence that data stored in TiDB was impacted." NebuSec says that, based on the evidence available, the attacker did not access live customer TiDB clusters. (PingCAP, NebuSec)
- The API keys. PingCAP says the API-key values were encrypted and it has found no evidence any were decrypted or used. NebuSec says the encryption key was not exposed. PingCAP still asks every customer to replace them. (PingCAP customer actions, NebuSec)
- Phishing risk. Because contacts and billing details were copied, PingCAP warns that fake messages about passwords, codes or payment changes can look real. (PingCAP customer actions)
Who should worry
- Your website, online store, booking system or app keeps its data in TiDB Cloud.
- Your developer or agency uses TiDB Cloud for your projects or your clients' projects.
- Anyone on your team has sent PingCAP support passwords, keys, connection strings or logs.
- You are not sure which database service your developer uses. Ask.
Leaked keys and passwords can let someone into the systems they unlock. Billing and contract details are what a convincing fake invoice or "update your payment details" email needs. PingCAP says it will contact affected customers directly, and asks everyone to act now instead of waiting. (PingCAP customer actions, PingCAP CEO note)
What to do now
Do these today.
- Ask the question. Send the message below to your developer or agency. You need a clear yes or no: does anything we run use TiDB Cloud?
- Replace every active TiDB Cloud management API key. PingCAP says organization owners should create a new key, move every app and script to it, check that each one works, then delete the old key. Delete keys you no longer need. (PingCAP customer actions)
- If you think a key was misused, delete it at once. PingCAP says not to wait to create the replacement first, and to contact its security team. Do not put passwords or keys in that message. (PingCAP customer actions)
- Change anything you shared with PingCAP support. That includes passwords, keys, connection strings and logs that contained secrets. Change them in the system they belong to. (PingCAP CEO note, NebuSec)
- Change passwords typed into the SQL editor. PingCAP lists SQL editor text among the copied records. If anyone typed a database password there, for example when creating a database user, change it. This is our advice, based on PingCAP's list. (PingCAP)
- Warn your team about fake messages. Check any request about passwords, codes or payment changes through a contact you already trust, not the details in the message. (PingCAP customer actions)
What to send your developer or agency
On October 19, 2026, PingCAP disclosed that an unauthorized party used stolen credentials to access its internal systems between September 9 and October 7, 2026, and copied TiDB Cloud account records, customer contacts and billing details, SQL editor text, source code and encrypted TiDB Cloud API-key values. Its investigator, NebuSec, says credentials customers had shared with PingCAP support were also taken. PingCAP asks all customers to replace active TiDB Cloud management API keys now. Please confirm whether any of our sites, stores or apps use TiDB Cloud. If so, please replace every active management API key today, delete unused keys, change any password, key or connection string we ever shared with PingCAP support or typed into the TiDB Cloud SQL editor, review logs since September 9 for activity we do not recognize, and tell us what you find. Sources: PingCAP incident report, PingCAP customer actions.
Technical steps
Step 1. In the TiDB Cloud console, switch to each organization you own and open Organization Settings, then API Keys. List every key. Only an organization owner can create or delete keys. (PingCAP customer actions)
Step 2. Click Create API Key, give it the role and scope the job needs, and save the private key somewhere secure. It is shown only once. (PingCAP customer actions)
Step 3. Replace the old key in every application, script and automation, and confirm each one works. Then delete the old key from its row menu. Repeat for each organization. (PingCAP customer actions)
Step 4. Search support tickets and saved SQL for secrets that passed through PingCAP, such as AWS keys, database passwords and connection strings, and rotate each in the system it belongs to. Rotating a TiDB Cloud API key does not change a database user's password or a key for another service. (NebuSec, PingCAP CEO note)
Step 5. Review the logs available to you for activity you do not recognize since September 9, including cloud logs for any AWS keys shared with support. (PingCAP customer actions, NebuSec)
Common questions
Has my business been hacked?
This notice does not mean your business has been hacked. PingCAP says it has found no evidence that data in customers' TiDB databases was accessed, and it is still working out which customers' records were copied. But PingCAP asks every customer to replace their API keys as a precaution, and so do we. (PingCAP, PingCAP customer actions)
Can EverThread tell me if I am affected?
No. EverThread checks websites from the outside, the way a browser sees them. We do not test for this. We cannot see your TiDB Cloud account, your API keys, your support history or your logs, so we cannot tell whether your data or keys were exposed or used. Your developer and PingCAP can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
My site does not use TiDB Cloud. Do I need to do anything?
Not for this incident. If you are not sure which database service your site or app uses, ask your developer.
Where can I follow official updates?
PingCAP's incident report, its customer actions page and its CEO's note.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- PingCAP: Security Update: October 2026 Security Incident Report: Unauthorized Access to PingCAP Cloud Resources, October 19, 2026
- PingCAP: Security Incident: Recommended Customer Actions, October 20, 2026
- PingCAP: A Note from Our CEO on Our Security Incident, Max Liu, October 23, 2026
- NebuSec: Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection, October 21, 2026