PingCAP confirms TiDB Cloud breach: stolen credentials used to copy customer data and source code

PingCAP disclosed in an incident report published on October 19, 2026 that between September 9 and October 7, 2026 an unauthorized party used stolen service account credentials to access certain internal systems, copy data and obtain source code. The company became aware of the incident on October 7 and began disabling the affected credentials the same day. Exported records included TiDB Cloud user names and email addresses, organization and project associations, SQL editor text and errors, customer contacts, contract terms, orders, pricing, payment terms and billing configuration, plus a table of encrypted API keys. PingCAP says there is no evidence that data stored in TiDB databases was impacted, that the attacker ran commands or maintained persistent access in the systems reviewed, and that as of October 14 all identified compromised credentials had been invalidated and the identified access paths blocked.

PingCAP says customer-specific impact is still being determined and has advised all TiDB Cloud owners to replace their management API keys. The extortion group FulcrumSec has made much larger claims, including 10.6 TB of data and plaintext keys; those claims are not confirmed by PingCAP and are not carried here as fact. No record count has been stated, so this is prepared as a Cybersecurity item, not a Breaches add, following the Railway and Zeabur precedents.

Sources: PingCAP; Dark Reading