Stolen credentials used to access PingCAP systems and source code
Original title: Unauthorized Access to PingCAP Cloud Resources
Access ran from September 9 to October 7; customer-specific impact and credential usability remain under investigation.
Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access PingCAP internal systems, copy data, and obtain source code. PingCAP disabled affected credentials after learning of the incident on October 7 and says all identified paths were blocked by October 14. An external firm found no evidence of commands or persistent access in reviewed production systems, and no evidence TiDB-stored data was impacted. Customer-specific exposure, including names, emails, billing records, and encrypted API-key values, is still being scoped.
Unconfirmed: Whether exported API-key values are usable, and which customers were affected, remains unverified.
- Exported records included SQL editor text, contract terms, orders, pricing, and billing configuration.
- Four vulnerabilities reported October 12-13 were fixed and retested by October 14.
- One tested encrypted API-key value could not be used directly as an API key.
- Affected customers will be notified once customer-specific impact is established.
Impact: copied internal data, source code, and customer account and billing records
| Product | Affected |
|---|---|
| PingCAP TiDB Cloud | — |
- 1.Contact security@pingcap.com with questions about possible exposure.
- ATT&CK
- T1078 Valid Accounts
- Vendors
- PingCAP
- Products
- TiDBTiDB Cloud
- Victims
- PingCAP
From the original article
3 min read at pingcap.com
Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code. PingCAP became aware of the incident on October 7 and began disabling the affected credentials the same day.
By pingcap.com via eatonphil · pingcap.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.