Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code. PingCAP became aware of the incident on October 7 and began disabling the affected credentials the same day.
An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed. That finding does not change the data exposure described below. With support from outside counsel and third-party forensic specialists, there is no evidence that data stored in TiDB was impacted. We keep on investigating and will provide updates on any new findings. As of October 14, all identified compromised credentials have been invalidated, and the identified unauthorized access paths have been blocked. The remaining investigation focuses on customer-specific impact and possible exploitation before remediation.
What This Means for Customer Data
Based on our investigation with an external incident response firm, including a review of the exported records, the categories below describe the customer data identified as affected to date. These findings do not mean that every customer had every category of information exposed. We are determining the scope for each customer.
Actions Completed by October 14
Work Continuing (Status as of October 19)
How We Will Keep You Informed
We will notify affected customers directly once we have established customer-specific impact. For questions, [email protected] .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
