PingCAP Review: TiDB Cloud Breach Exposes 10.6 TB of Data

PingCAP's TiDB Cloud service faced unauthorized access between September 9 and October 7, 2026, after attackers used stolen service account credentials. The incident resulted in claims of 10.6 TB of data exfiltration, including control-plane information and customer metadata. PingCAP confirmed the breach on October 19 and provided details on containment steps taken by October 14.

PingCAP Review of Breach Timeline and Access Method

Attackers accessed internal systems through credentials reportedly obtained from PingCAP repositories, including keys for Google Cloud and Azure environments. They performed multiple exports of control-plane data over several weeks without detection until October 7. PingCAP invalidated all compromised credentials and blocked related access paths by October 14, while also fixing four identified vulnerabilities.

The company stated that no evidence exists of attacker commands or persistent access in production systems housing customer TiDB clusters. External forensics supported this assessment. Customer-specific impact reviews continue, with direct notifications planned for affected organizations.

Stolen data categories confirmed by PingCAP include TiDB Cloud account details such as usernames, emails, and project associations, along with billing contacts, contracts, and orders. Encrypted API key values appear in the dataset, though private key portions were not confirmed exposed. SQL editor text, errors, and connection logs were also accessed.

TiDB Cloud Security and Customer Data Exposure Details

Attacker claims list approximately 180,000 tenant organizations and 403,000 unique emails among the exfiltrated materials. They further allege exposure of 115,000 plaintext customer API keys, with 42,600 marked as active at the time. Additional items include source code from 413 private repositories, Jira and CRM records, and customer server IP addresses.

PingCAP emphasized that data stored inside customer TiDB clusters and credit card information showed no signs of access. Scope of exposure varies by customer, and not every category affected all accounts. A Japanese notice referenced roughly 50,000 potentially affected personal records in that region.

Crypto exchange Bitget confirmed prior use of TiDB Cloud but stated it stored only public trade logs with no sensitive user data or passwords. The company ended use more than two months before the incident and reported no impact on its users. Other named entities such as Pionex appear in attacker records without independent confirmation of sensitive data exposure.

Database Breach Review: Next Steps and Ongoing Risks

Customers should rotate any TiDB Cloud API keys, review access logs for unusual activity, and monitor communications from PingCAP. FulcrumSec, the group claiming responsibility, indicated plans for additional data releases. No regulatory actions or confirmed downstream incidents involving customer funds or cluster contents have been reported as of October 21, 2026.

TiDB Cloud serves as a managed distributed SQL database used by enterprises for production workloads. Unverified claims about prior internal findings from 2022, including privilege management issues, remain unconfirmed by independent sources. The incident highlights risks tied to credential storage in development repositories.

Organizations evaluating database providers can compare exposure patterns across similar managed services. Regular audits of service account permissions and separation of credentials from code repositories reduce similar risks. PingCAP continues its investigation with further updates expected.