Unauthorized Access to PingCAP Cloud Resources

Between September 9 and October 7, 2026, unauthorized access occurred to certain PingCAP internal systems by an individual who had stolen service account credentials. The incident involved copying data and obtaining source code. PingCAP detected the unauthorized access on October 7 and promptly disabled the affected credentials on the same day.

An external incident response firm evaluated PingCAP's production systems and did not find any evidence that the attacker executed commands or maintained persistent access in the reviewed systems. However, the finding does not negate the data exposure stated below. PingCAP is continuing its investigation with the support of outside counsel and third-party forensic specialists and has found no evidence that data stored in TiDB was impacted.

As of October 14, all identified compromised credentials have been invalidated, and the unauthorized access paths have been blocked. The ongoing investigation is focused on determining the customer-specific impact and any potential exploitation before remediation. PingCAP will notify affected customers directly once the customer-specific impact has been established. For inquiries, customers can reach out to security@pingcap.com.