Data breach investigation
PingCAP / TiDB Cloud Data Breach Investigation
PingCAP · TiDB Cloud · October 2026 Security Disclosure
Hall Attorneys is investigating potential claims arising from PingCAP’s disclosed security incident involving TiDB Cloud customer information. Our inquiry concerns the protection of information entrusted to PingCAP, customer notices, and related response costs or losses. An individual’s exposure and any legal claims require a separate review.
What did PingCAP disclose?
PingCAP’s October 19, 2026 report describes unauthorized access from September 9 through October 7 using stolen credentials. Source code and internal records were copied. PingCAP says it detected the activity on October 7 and blocked all identified access paths by October 14.
NebuSec’s October 21 investigation traces the intrusion to a compromised GitHub account and exposed credentials. It found no evidence that data stored in customers’ TiDB databases was accessed. Customer-related records copied from internal analytics, storage, and support systems are a separate exposure.
This page relies on the company disclosure and investigator findings. Broader claims about stolen-data volumes, usable credentials, or particular downstream victims are not treated as confirmed here.
What information was involved?
PingCAP identifies account names and emails, project associations, SQL editor text and errors, customer contacts, contracts, and billing records among the exported information. The exposure varies by customer; not every customer had every category involved.
NebuSec reports that exported TiDB Cloud API-key values were encrypted and the encryption key was not exposed. That protection does not extend to credentials shared in support materials. Its findings also describe copied support tickets, attachments, and diagnostic materials.
We are reviewing which information was held about each person or organization, the notices they received, and any documented misuse or consequences. A TiDB Cloud account or a relationship with a PingCAP customer does not, by itself, establish that a particular person’s information was involved.
What does PingCAP recommend?
PingCAP advises customers to replace active TiDB Cloud management API keys without waiting for individual notice. Its instructions distinguish routine replacement from suspected misuse: normally, create replacement keys, update and verify dependent applications, then revoke the old keys; if misuse is suspected, revoke immediately and contact PingCAP security.
NebuSec also recommends rotating credentials shared with PingCAP support. PingCAP warns about targeted phishing and recommends verifying unexpected requests through a trusted channel. Follow the linked guidance for operational steps and contact security@pingcap.com for customer-specific incident questions.
A case review does not require delaying security measures or sending the firm any credential values.
Who should contact Hall Attorneys?
We would like to hear from TiDB Cloud users, customer organizations, account administrators, and people who provided information to PingCAP, particularly those who:
- Received an incident notice or customer-specific assessment identifying information involved.
- Shared credentials, logs, query text, or other sensitive information through PingCAP support and are concerned about that material.
- Experienced potentially related unauthorized activity, targeted messages, investigation costs, credential-rotation expenses, service disruption, or financial loss.
You do not need an individual notice or known financial loss to request a review. These are examples of experiences we are investigating, not established consequences for every customer. Compensation and legal responsibility have not been determined.
What should you preserve?
Keep incident notices, customer-impact assessments, support-ticket references, account alerts, and communications with PingCAP. Preserve existing audit logs and a dated record of response work, operational interruptions, expenses, and any suspected misuse.
Do not send API keys, passwords, tokens, private keys, connection strings, raw support attachments, customer database contents, or other confidential records in an initial inquiry. Describe the records you already have; if documents are needed, we will discuss an appropriate way to provide them.
Do not search for, download, or share allegedly stolen records. Keep your own evidence and a brief timeline without including active secrets.
Contact Hall Attorneys
Provide your name, preferred contact information, your relationship to PingCAP or TiDB Cloud, and whether you received a notice. Briefly describe your concern, the approximate dates, and any response costs or losses.
An initial inquiry should describe the issue without including secrets or confidential customer information. We will discuss any further records after reviewing your inquiry.
Nicholas Hall
Email: nhall@hallattorneys.com
Request a Case ReviewAttorney Advertising. Responsible attorney: Nicholas Hall, Hall Attorneys, P.C., Edna, Texas. Hall Attorneys is not affiliated with PingCAP. This page describes an investigation, not a filed lawsuit by Hall Attorneys concerning this incident. Individual exposure, legal responsibility, and compensation have not been determined. It provides general information, not legal advice. Contacting the firm or submitting information does not create an attorney-client relationship. No outcome is guaranteed.