{"slug": "a-note-from-our-ceo-on-the-pingcap-security-incident", "title": "A Note from Our CEO on the PingCAP Security Incident", "summary": "PingCAP co-founder and CEO Max Liu disclosed that an unauthorized party used a compromised GitHub account and exposed credentials to access PingCAP's internal systems between September 9 and October 7, 2026, copying source code and customer records from internal analytics, storage and support environments. Independent investigator NebuSec found no evidence that data stored in customers' TiDB databases was accessed and no evidence of attacker persistence in production, and PingCAP says all identified compromised credentials were invalidated and the vulnerabilities NebuSec found were fixed and retested. PingCAP is directing customers to replace TiDB Cloud management API keys and rotate any credentials, keys, connection strings or logs shared with its support team, and Liu said internal systems holding customer information must now meet the same security standard as production.", "body_md": "Max Liu, Co-founder and CEO, PingCAP | Published: October 23, 2026\n\nAs part of our commitment to transparency, I want to provide our customers and partners with a direct update on a recent security incident affecting our PingCAP systems.\n\nBetween September 9 and October 7, 2026, an unauthorized party used compromised credentials to access PingCAP’s internal systems and copy information from them, including information our customers entrusted to us.\n\nWe did not protect that information as we should have. I’m sorry for the exposure itself, for the work it has created for your teams, and for the concern it has caused the people whose information was involved. This happened on my watch. I take responsibility for it, and for fixing it.\n\n## What the Independent Investigation Found\n\nWe take this incident seriously and engaged with multiple cybersecurity firms to conduct independent investigations. NebuSec has completed its investigation and [published its findings here](https://nebusec.ai/research/pingcap-security-incident/). In short:\n\n- Between September 9 and October 7, 2026, an attacker used a compromised GitHub account and exposed credentials to access PingCAP’s internal systems, obtain source code, and copy records from internal analytics, storage, and support environments.\n- NebuSec found no evidence that data stored in customers’ TiDB databases was accessed, and no evidence of attacker persistence in our production environment.\n- Customer-related information was copied from internal analytics, storage and support systems. NebuSec’s report lists each category of data and where it came from.\n- TiDB Cloud API-key values in the exported data were encrypted, and the encryption key was not exposed. This does not apply to credentials that were shared in support materials.\n- All identified compromised credentials were invalidated, and the vulnerabilities NebuSec found during its review were fixed and retested, with no evidence they had been exploited.\n\nThe scope and types of data exposure described in NebuSec’s report vary by customer. Please contact the PingCAP team for an assessment of the impact on your organization.\n\n## What to Do Now\n\n- **Replace your TiDB Cloud management API keys** , following the steps in our[customer actions page](https://www.pingcap.com/trust-hub/security/customer-actions-october-2026/) .\n- **Rotate anything you have shared with PingCAP support** — credentials, keys, connection strings, or logs containing secrets.\n- **Be alert to targeted phishing.** Verify any request involving passwords, verification codes or payment changes through a channel you already trust.\n\nWe are determining customer-specific impact and will contact affected customers directly. Please follow these steps now rather than waiting for an individual notice.\n\n## What Changes\n\nInternal systems that hold customer information must meet the same security standard as production. Every credential must have an owner and only the access it needs. Unusual access and large data movements must be detected and acted on. NebuSec’s report describes the containment and hardening work completed so far, and that work continues.\n\nIf you have questions, contact our security team at [security@pingcap.com](mailto:security@pingcap.com). Please do not include passwords, tokens, keys or other secrets. Our [incident report](https://www.pingcap.com/trust-hub/security/security-update-october-2026/) remains the reference for this incident.\n\nMax Liu\n\nCo-founder and CEO, PingCAP", "url": "https://wpnews.pro/news/a-note-from-our-ceo-on-the-pingcap-security-incident", "canonical_source": "https://www.pingcap.com/trust-hub/security/ceo-note-october-2026/", "published_at": "2026-10-23 20:21:49+00:00", "updated_at": "2026-10-23 20:43:00.444473+00:00", "lang": "en", "topics": ["ai-infrastructure"], "entities": ["PingCAP", "Max Liu", "NebuSec", "TiDB", "TiDB Cloud", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/a-note-from-our-ceo-on-the-pingcap-security-incident", "markdown": "https://wpnews.pro/news/a-note-from-our-ceo-on-the-pingcap-security-incident.md", "text": "https://wpnews.pro/news/a-note-from-our-ceo-on-the-pingcap-security-incident.txt", "jsonld": "https://wpnews.pro/news/a-note-from-our-ceo-on-the-pingcap-security-incident.jsonld"}}