Overview
PingCAP, the company behind the TiDB distributed database and its managed TiDB Cloud service, has disclosed an intrusion into its internal systems. Records tied to TiDB Cloud accounts were copied, including billing details. PingCAP says it has found no evidence that data stored inside customer TiDB databases was affected.
A group calling itself FulcrumSec claims a much larger haul and listed PingCAP / TiDB Cloud on its leak site on October 19, 2026. That claim has not been independently verified.
What PingCAP Says Happened
| Item | Detail |
|---|---|
| Access method | Stolen service credentials |
| Dwell time | September 9 – October 7, 2026 |
| Detected | October 7, 2026 |
| Containment | Affected credentials disabled from October 7; identified access routes closed and four vulnerabilities repaired by October 14 |
| Customer data in TiDB | No evidence of impact, based on systems reviewed with outside counsel and third-party forensics |
Data Copied
According to PingCAP's security update, the copied material included:
- User names and email addresses
- Project information
- SQL editor text and error messages
- Customer contact and billing details
- Source code
- One exported table containing encrypted API-key values
PingCAP is still working out which customers were affected and says it will notify them directly.
The Attacker's Claims
FulcrumSec says it took roughly 10.6 TB across about 4.9 million files, including customer organization records, API keys, database logs, internal source code and business materials. Treat the figures as unconfirmed until PingCAP or an independent party corroborates them.
Customer reaction so far:
- Bitget said a cloud database it previously used was affected, but that only public trade logs were exposed and no user data or passwords were involved.
- Pionex and Baidu have also been reported as affected; PingCAP responses are pending.
Why It Matters
The incident is a reminder of a gap in cloud security assumptions. Even when a provider never touches the data in your database, it still holds metadata about your use of it. Here that included SQL editor contents, which can carry table names, query text and sometimes pasted credentials or sample data. Customers may not realize that the provider's control plane stores any of this.
Recommended Actions
- Rotate TiDB Cloud API keys and any credentials that were ever pasted into the SQL editor, even though the stored key values were encrypted.
- Review SQL editor history for secrets, connection strings and sensitive sample data.
- Watch for phishing that references your TiDB Cloud account, billing or projects, since contact and billing details were copied.
- Audit TiDB Cloud access logs and IP allowlists for unexpected activity since September 9.
- Check your vendor inventory for other services that may use TiDB Cloud on your behalf.
- Watch for PingCAP's direct notification and keep records for any regulatory reporting obligations.