For: administrators of organizations that use TiDB Cloud, and people who have contracted or contacted PingCAP. This article is based on the company's official notices and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
administrators of organizations that use TiDB Cloud, and people who have contracted or contacted PingCAP.
- Confirmed so farSee the table ↓
- TiDB Cloud account data
- Support ticket information
- Business and billing information
1 more
- Public Key part of API keys
- Not yet confirmed
- Impact for each affected customer
- Whether and when customers are notified individually
- What the Japan figure of about 50,000 counts (people or records)
3 more
- How the credentials were obtained
- The full range of data obtained, including source code (not in the Japanese notice)
- Whether any misuse (secondary damage) occurs
- What to do nowSee the steps ↓
- Rotate your API keys
- Review access logs, and organization members and roles
- Look back at what you pasted into the SQL editor and support tickets
2 more
- Check anything claiming to be from PingCAP without opening links
- Send inquiries to the contact on the notice page
- Where to verify (source)All sources ↓
- PingCAP K.K., Japanese notice of the data leak from unauthorized access (addendum October 21, 2026 at 13:05; checked November 3)
- Last checked
- As of November 3, 2026
Follow-up plans and what we checked
In its Japanese notice the company says it will provide updates as new facts emerge, and that it is continuing the investigation with an external investigator. On November 3 we checked the text of both the Japanese and English notices. The Japanese notice has an addendum dated October 21, 2026 at 13:05 (adding inquiry information); we found no newer update.
What TiDB Cloud organization admins should do today
Rotate your API keys
The company asks customers who have issued TiDB Cloud API keys to rotate them. It says the Private Key part was not exposed. This site's view: the Public Key part (stored encrypted) is among the categories confirmed as affected.
- This site's addition: disable the old key, then switch the services that use the new key (CI/CD, automation scripts) over to it
- This site's addition: delete keys you no longer use rather than recreating them
Review access logs, and organization members and roles
The company asks customers to check access logs for TiDB Cloud and related cloud accounts for suspicious IP addresses or actions they do not recognize, and to review organization members and roles and consider removing unneeded accounts or adjusting permissions.
- Any sign-in, key creation or member addition you do not recognize
- Accounts of people who left or moved, or of contractors you no longer use
- Admin rights only for those who need them
Look back at what you pasted into the SQL editor and support tickets
The categories the company confirmed as affected include SQL editor execution history and error information, and inquiry information (support tickets). The English notice says "SQL editor text and errors"; the Japanese notice does not say whether the body of executed statements is included.
- If you remember pasting connection strings, passwords, tokens or API keys, change them as if leaked (this site's advice)
- If you pasted personal or business data, tell the person in charge of personal data at your organization
- In future, mask secrets before pasting them into support requests
Check anything claiming to be from PingCAP without opening links
The company says emails posing as the company, or suspicious emails related to this incident, may arrive. It asks you to avoid replying or clicking links and to contact its incident contact, and says it does not ask for passwords or access keys by email.
A message that seems to know your organization name, project names or a support ticket topic is not proof it is genuine (this site's view). What is phishing?
Send inquiries to the contact on the notice page
The Japanese notice names security-jp@pingcap.com as the incident contact of PingCAP K.K. The English notice names security@pingcap.com. Confirm the address on the official notice page.
1. An email or call claiming to be PingCAP or its support
It names your organization or a ticket topic: not proof
↓
2. Skip its links; open the official notice page or console yourself
↓
3-A Not on the official side
Asks for passwords or access keys: do not comply, report it
3-B Same notice on the official side
Follow the official guidance
What happened (from PingCAP's notices)
The following is based on the company's Japanese notice (titled with an apology and report on the data leak from unauthorized access) and its English notice (Trust Hub, Security Update – October 2026).
September 9 to October 7, 2026 (US time)
A third party using unlawfully obtained account credentials entered internal systems and copied data (company's explanation)October 7
The company became aware of the incident and began invalidating the affected credentials the same day (company's explanation)October 10 to 14
According to the English notice: on the 10th it deleted additional credentials, reduced excessive permissions between cloud projects and added storage access logging; by the 14th it had invalidated all identified credentials and blocked the identified access paths. (The Japanese notice also says the identified access paths were blocked.)October 19
The English notice page carries this date (the English notice reads "Published: October 19, 2026")October 21, 13:05
Addendum to the Japanese notice adding inquiry information (support tickets). The Japanese page states no first-publication dateNovember 3
This site checked the text of both notices. No update newer than the October 21 addendum found
- TiDB Cloud account data
- User names, email addresses, organization and project associations, SQL editor execution history and errors (including organization, project and cluster IDs), and inquiry information (support tickets, added October 21). Varies by customer
- Business and billing information
- Contacts (name, email address, company name, phone number) and contract terms (orders, payment terms, billing settings)
- Credentials
- The Public Key part of TiDB Cloud API keys (stored encrypted). The company says the Private Key part was not exposed and that the Public Key alone cannot operate TiDB Cloud
- Not confirmed
- Credit card leakage and unauthorized access to TiDB Cloud (Japanese notice). The English notice says there is no evidence that data stored in TiDB was impacted and no evidence of commands run in the production systems reviewed
- Only in the English notice
- It says the third party obtained source code. The Japanese notice does not say this
- Company's response
- Verifying scope and identifying access paths with an external security firm; rotating exposed keys and critical administrative keys, tightening permissions, reviewing network management, adding new threat detection; notifying law enforcement and the relevant supervisory authorities (Japanese notice)
What is known and not yet known
The state as of November 3, 2026. This table will be rewritten when follow-ups appear.
| Item | What the notice says | Status |
|---|---|---|
| Period of unauthorized access | September 9 to October 7, 2026 (US time) | Stated by the company (investigation ongoing) |
| Count | Up to about 50,000 personal records in Japan. The unit (people or records) is not stated. The English notice gives no count | Up to (company, Japanese notice) |
| TiDB Cloud account data | User names, email addresses, organization and project associations, SQL editor execution history and errors | Leak confirmed (company) |
| Support ticket information | Added by the October 21 addendum | Leak confirmed (company) |
| Business and billing information | Contacts, orders, payment terms, billing settings | Leak confirmed (company) |
| Public Key part of API keys | Stored encrypted. The Private Key was not exposed, so the Public Key alone cannot operate TiDB Cloud | Leak confirmed (company). The English notice says it is undetermined whether other usable credentials were exposed |
| Private Key part of API keys | Not exposed | Not included (company) |
| Impact per customer | Varies; not every item applies to every customer. The English notice says it is determining per-customer impact | Under investigation (English notice) |
| Body of statements run in the SQL editor | Not stated in the Japanese notice (English notice: "SQL editor text and errors") | Not stated |
| Credit card information | Leakage not confirmed | Not confirmed (company) |
| Unauthorized access to TiDB Cloud | Not confirmed. The English notice also says no evidence that data stored in TiDB was impacted | Not confirmed (company) |
| Source code | The English notice says it was obtained. Not stated in the Japanese notice | Stated in English notice; not in Japanese |
| Access path | Identified and blocked. How the credentials were obtained is not stated | Under investigation (how) |
| Individual notification | Not stated in the Japanese notice. The English notice says it will notify affected customers directly once impact is established | Under investigation (English notice) |
| Misuse (secondary damage) | Not stated | Not stated |
| Reports to authorities | The company says it notified law enforcement and the relevant supervisory authorities. This site has not confirmed an announcement from an authority | Company's explanation |
How to read this: where the Japanese and English notices differ
The company's Japanese and English notices differ in some items (source code, the count, the contact address and dates). This site states which notice each point comes from. The figure of up to about 50,000 appears only in the Japanese notice and is for Japan, not a worldwide count.
What contact details, SQL history and support tickets can lead to
The following is what such a combination of items can generally lead to; it is not something the company has said happened here.
- Name + email + company name + phone + order details: material for messages posing as the company or a business partner that seem to know your contract or billing
- Organization, project and cluster ID associations: lets someone write a convincing message that seems to know which environment you use
- SQL editor history and errors: if connection target names, table structure or pasted credentials are included, treat them as exposed (the notices do not say whether they are included)
- Support tickets: can contain a description of an outage or environment and pasted settings or credentials. They can be used for "follow-up to your support request" messages
- Public Key part of API keys: the company says it is encrypted and cannot operate anything without the Private Key. Rotation is still a low-effort, safe-side step (this site's advice)
What operators and cloud users should review
How the credentials were stolen has not been published. Here are only general review points that follow from the published facts (stolen account credentials were used to enter internal systems, information remained in support and history, keys were rotated).
- What you send to support: strip passwords, tokens and connection strings from configuration and logs you paste. If needed, give temporary credentials and revoke them afterwards
- SQL editor and console history: use them assuming secrets left in history will persist. Do not write credentials directly in SQL; pass them from a secrets management mechanism
- API key management: separate keys by purpose, limit permissions (least privilege), rotate regularly, and inventory and delete unused keys (this site's addition; Environment variables and API keys basics)
- Prepare for a vendor incident: limit who can enter the vendor's console, require multi-factor authentication and enable sign-in and key-creation notifications (Choosing multi-factor authentication)
These are general review points and do not mean the company or its users failed to do them.
Sources (public records)
The facts in this article come from the public information below. We have not guessed at undisclosed circumstances or the range of data obtained.
- PingCAP K.K., Japanese notice of the data leak from unauthorized access (addendum October 21, 2026 at 13:05; checked November 3) — pingcap.co.jp
- PingCAP, "Security Update – October 2026" (English, headquarters; checked November 3) — pingcap.com
Update history
2026-11-03: First version. Based on the company's Japanese notice (including the October 21 addendum) and English notice (checked November 3; no newer update found).
Read next
- Incidents that start with credentials: 2026 breaches that began with stolen credentials
- Managing API keys and secrets: Environment variables and API keys basics / Leaked credentials that stay valid
- Similar incidents: Railway secrets exposure, Northflank incident and API keys
- Preparing for scam messages: What is phishing?
- Protect your accounts: Choosing multi-factor authentication
- Other 2026 incidents: Data breaches and cyberattacks (Japan and overseas)