Max Liu, Co-founder and CEO, PingCAP | Published: October 23, 2026
As part of our commitment to transparency, I want to provide our customers and partners with a direct update on a recent security incident affecting our PingCAP systems.
Between September 9 and October 7, 2026, an unauthorized party used compromised credentials to access PingCAP’s internal systems and copy information from them, including information our customers entrusted to us.
We did not protect that information as we should have. I’m sorry for the exposure itself, for the work it has created for your teams, and for the concern it has caused the people whose information was involved. This happened on my watch. I take responsibility for it, and for fixing it.
What the Independent Investigation Found #
We take this incident seriously and engaged with multiple cybersecurity firms to conduct independent investigations. NebuSec has completed its investigation and published its findings here. In short:
- Between September 9 and October 7, 2026, an attacker used a compromised GitHub account and exposed credentials to access PingCAP’s internal systems, obtain source code, and copy records from internal analytics, storage, and support environments.
- NebuSec found no evidence that data stored in customers’ TiDB databases was accessed, and no evidence of attacker persistence in our production environment.
- Customer-related information was copied from internal analytics, storage and support systems. NebuSec’s report lists each category of data and where it came from.
- TiDB Cloud API-key values in the exported data were encrypted, and the encryption key was not exposed. This does not apply to credentials that were shared in support materials.
- All identified compromised credentials were invalidated, and the vulnerabilities NebuSec found during its review were fixed and retested, with no evidence they had been exploited.
The scope and types of data exposure described in NebuSec’s report vary by customer. Please contact the PingCAP team for an assessment of the impact on your organization.
What to Do Now #
- Replace your TiDB Cloud management API keys , following the steps in ourcustomer actions page .
- Rotate anything you have shared with PingCAP support — credentials, keys, connection strings, or logs containing secrets.
- Be alert to targeted phishing. Verify any request involving passwords, verification codes or payment changes through a channel you already trust.
We are determining customer-specific impact and will contact affected customers directly. Please follow these steps now rather than waiting for an individual notice.
What Changes #
Internal systems that hold customer information must meet the same security standard as production. Every credential must have an owner and only the access it needs. Unusual access and large data movements must be detected and acted on. NebuSec’s report describes the containment and hardening work completed so far, and that work continues.
If you have questions, contact our security team at security@pingcap.com. Please do not include passwords, tokens, keys or other secrets. Our incident report remains the reference for this incident. Max Liu
Co-founder and CEO, PingCAP