PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken
› PingCAP TiDB Cloud (hosted database platform)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Sep 9, 2026
- closed
- ongoing
- CVEs
- none
- sources
- 3
## summary
PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.
severity: Confirmed data + source code theft; attacker claims unverified
## affected
- TiDB Cloud customers (customer-specific impact still being determined)
## fixed in
no fixed release yet
## timeline[6]
PingCAP Japan adds support-ticket information to the list of exposed data.
sourceFulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there.
sourcePingCAP publishes incident report; Japan notice cites up to ~50,000 personal records.
sourceAll identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed.
sourcePingCAP detects the intrusion and starts disabling credentials.
sourceUnauthorized access with stolen service-account credentials begins.
source
## advisories[2]
## news & write-ups[1]
## notes & caveats
Attacker figures (10.6 TB, 115,308 plaintext API keys, 42,612 active) are FulcrumSec claims only, not independently verified; PingCAP says the exported API-key table was encrypted and a tested value was unusable. Deliberately not linking the extortion leak site. Rotate TiDB Cloud API keys and review logs.
