TiDB Cloud review: Stolen credentials exposed customer and billing data in October 2026

Stolen credentials provided access to PingCAP internal systems tied to TiDB Cloud between September 9 and October 7, 2026. The company confirmed that usernames, email addresses, billing details, and support records were copied, while customer TiDB databases remained untouched. Users should rotate management API keys immediately and monitor support channels for direct notifications.

TiDB Cloud security review: Timeline and access method

PingCAP reported that attackers used compromised service account credentials and a GitHub account to enter internal environments. Access began on September 9, 2026. The company identified the intrusion on October 7 and started disabling the affected credentials that same day. By October 10, remaining excessive permissions were removed. Additional access paths were closed and four vulnerabilities were fixed by October 14. Investigation continued through October 23.

The credentials had been stored in Git repositories, Terraform state files, and support tickets. Attackers copied metadata from analytics, storage, and support systems. They also obtained source code and Jira records. No evidence emerged of command execution or persistence inside production customer clusters.

Independent analysis by NebuSec reviewed the same data sets and reached the same conclusion: customer TiDB databases were not accessed. Encrypted API key values appeared in one export, but the encryption key itself stayed protected and one tested value proved unusable.

Data categories copied and scale of exposure

PingCAP listed the specific records that left its systems. The categories include organization and project associations, SQL editor queries that sometimes contained cluster identifiers, and customer contact records with names, emails, company names, and phone numbers. Contract terms, orders, pricing, and payment configuration data were also copied. Support tickets added another layer of personal information, particularly in Japanese-language notices that mentioned up to 50,000 potentially affected records in Japan.

TiDB Cloud does not store credit card numbers in the control plane that was reached, and no confirmed card data appeared in the exported sets. Customer-specific notifications are still being prepared as PingCAP completes its impact assessment for each account.

CEO Max Liu stated that the company did not protect the information as it should have and accepted responsibility. All identified compromised credentials have been invalidated. The company continues to rotate keys, improve logging, and scan for additional exposure paths.

Practical steps for current TiDB Cloud users

Every TiDB Cloud customer should rotate active management API keys and any credentials previously shared with support. Organizations that used the SQL editor should review recent query logs for any sensitive identifiers that may have been captured. Support ticket history should be checked for mentions of production connection strings or keys.

Users can reduce future risk by storing infrastructure credentials outside Git repositories and by applying least-privilege policies to service accounts. Monitoring for phishing attempts remains advisable, because attackers already possess contact information for many organizations.

PingCAP has published updated guidance on its Trust Hub page. Affected customers will receive direct notices once individual assessments finish. As of October 26, 2026, no further public updates on the investigation have appeared.