PingCAP confirmed that attackers used stolen credentials to access internal systems between September and October 2026, copying source code and TiDB Cloud customer data including contact information, contract terms, billing details, and encrypted API keys. The exact number of affected individuals has not been disclosed. Affected customers should rotate API keys, watch for phishing, and monitor billing statements for unusual activity.
| Company | PingCAP |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Source Code, Names and Email Addresses, Contract and Billing Information, API Keys |
| People Affected | Not Publicly Disclosed |
| Attack Method | Stolen Credentials |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the PingCAP Data Breach?
PingCAP, the company behind the TiDB Cloud database platform, has confirmed a serious security incident. An unauthorized party used stolen service account credentials to break into internal company systems. As a result, the attacker was able to copy source code and customer-related records.
According to PingCAP, the breach activity took place between September 9 and October 7, 2026. During this window, the intruder moved through internal systems undetected. The company said unauthorized access to its network occurred in October 2026, when the activity was first identified.
PingCAP became aware of the incident on October 7, 2026. In response, the company began disabling the compromised credentials that same day. This quick action was meant to cut off the attacker’s continued access to internal environments. PingCAP has since conducted a forensic review to determine the scope of what was taken and how the intrusion happened.
Who was affected?
The breach affects customers of PingCAP’s TiDB Cloud service. Because the stolen data includes customer contacts, contract terms, and billing information, both individual users and business account holders tied to TiDB Cloud may be impacted.
PingCAP has not publicly disclosed an exact number of affected individuals. The company has also not detailed the full geographic breakdown of impacted customers. However, TiDB Cloud serves organizations and developers across multiple countries, including the United States, so the exposure is not limited to a single region.
It remains unclear whether any minors are among the affected population, though this is unlikely given the business-focused nature of the platform. Employees tied to internal systems, such as the SQL editor and customer contact records, could also be indirectly affected if their information appeared within those exposed systems.
What Information Was Potentially Exposed?
PingCAP has stated specific categories of data that were copied during this incident. The exposed information centers on both internal source code and customer account details tied to TiDB Cloud.
- Source code
- User names and email addresses
- Organization and project associations
- SQL editor text and associated error logs
- Customer contact information
- Contract terms
- Order details
- Pricing information
- Payment terms
- Billing configuration data
- Encrypted API-key values
This combination of data creates real risk for affected customers. For example, exposed email addresses and names could be used in targeted phishing campaigns that impersonate PingCAP or TiDB Cloud support staff. Because the attacker also obtained contract and billing details, scammers could craft highly convincing messages referencing real account information.
In addition, the exposure of encrypted API-key values raises concerns about downstream account compromise. Even though the keys were encrypted, any weakness in encryption strength or key management could allow further unauthorized access. This means affected organizations should treat any linked credentials as potentially at risk until PingCAP confirms otherwise.
What is the company doing?
PingCAP has taken immediate containment steps since discovering the breach. The company disabled the affected service account credentials on the same day it identified the intrusion. This action was intended to stop any further unauthorized access to internal systems.
Beyond containment, PingCAP has been investigating the full scope of the incident and has published details about what data was copied. The company has not announced whether it is offering credit monitoring or identity protection services to affected customers. As the investigation continues, PingCAP may release further updates detailing additional remediation steps or customer notifications.
What Should Affected Individuals Do?
Monitor Your Accounts and Credit Reports
Affected individuals should regularly check their financial accounts for unusual activity. Because contract and billing information was exposed, it’s wise to watch statements closely for unauthorized charges.
In addition, pulling a free credit report periodically can help catch signs of identity misuse early. Catching suspicious activity quickly often makes it easier to limit the damage and dispute fraudulent charges.
Stay Alert for Phishing Attempts
Because names, emails, and contract details were exposed, affected customers should expect an increase in targeted phishing attempts. Scammers often use real account details to make fraudulent emails look legitimate.
As a result, it’s important to avoid clicking links or downloading attachments from unexpected emails, even if they appear to reference real account information. Instead, verify any request by contacting PingCAP directly through official channels.
Rotate and Secure API Keys
Given that encrypted API-key values were part of the stolen data, affected customers should consider rotating any API keys linked to their TiDB Cloud accounts. This step reduces the risk that a decrypted or compromised key could be used to access connected systems.
Furthermore, enabling multi-factor authentication wherever possible adds another layer of protection. This makes it significantly harder for attackers to misuse stolen credentials even if they manage to decrypt or guess them.
Review Business Contracts and Billing Records
Because contract terms, pricing, and billing configuration data were exposed, organizations using TiDB Cloud should review their account agreements for unusual changes. This includes checking billing statements for unexpected charges or account modifications.
Moreover, businesses should inform their internal security and finance teams about the breach. This ensures that anyone managing vendor relationships is aware of the potential exposure and can watch for related fraud attempts.
Consult a Data Breach Attorney
Individuals and businesses concerned about how this breach may affect them can benefit from speaking with a data breach attorney. An attorney can help evaluate whether affected parties may have grounds for compensation.
Because laws around data breach liability vary by state, a free case evaluation can clarify specific rights and potential next steps. This is especially useful for business customers whose contract and billing data was part of the exposure.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.