PingCAP disclosed on October 19, 2026, that attackers used stolen service-account credentials to export TiDB Cloud SQL editor records and customer metadata. Its Japanese notice added inquiry and support-ticket information on October 21, 2026, at 13:05, without specifying a time zone. That notice reported up to approximately 50,000 personal-information records in Japan, which does not establish a count of unique people or customers. Sources: PingCAP, PingCAP Japan
PingCAP said confirmed exports included SQL editor text and errors, usernames, emails, and organization and project associations. They also included some organization, project and cluster identifiers. Other exports included customer contacts, contracts, orders, pricing, payment terms and billing configuration. Attackers also copied encrypted TiDB Cloud API-key values and source code, the company said. Sources: PingCAP
The English report said one investigator-owned exported value failed a direct-use API-key test. Other usable-credential exposure remained under investigation. The Japanese notice separately said encrypted public-key portions leaked but private-key portions did not. It said public portions alone cannot operate TiDB Cloud. Sources: PingCAP, PingCAP Japan
Sysdig strategist Crystal Morin told Dark Reading that debugging connection strings can leave secrets in query history and errors. Potential contents include credentials, literal application or customer values, and internal identifiers. PingCAP reported no evidence of impact to data stored in TiDB. Customer-specific exposure remains unresolved. PingCAP has not specified notification totals, affected retention periods or support-ticket attachment coverage. Sources: PingCAP, Dark Reading, PingCAP Japan
PingCAP dated unauthorized access to September 9–October 7, 2026. It said discovery and credential disabling began on October 7. By October 14, all identified compromised credentials and access paths had been disabled or blocked, the company said. Four vulnerabilities had been fixed and retested. Sources: PingCAP
What to do
- If you have issued TiDB Cloud API keys, follow the Japanese notice’s advice to rotate them.
- Inspect TiDB Cloud and related cloud-account access logs for unfamiliar activity, and review organization members and roles, as the Japanese notice advises.
- Watch for impersonation emails. Sources: PingCAP Japan