Summary
- Environment: GitHub, Google Cloud, internal collaboration systems and customer-support storage
- Operational impact: Internal data and source code copied; customer-specific exposure still under review
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 24, 2026; updated as evidence emerges.
What happened
Impact
Copied information included account and organization data, SQL editor history, business and billing records, support materials, internal chat and employee information. PingCAP was still determining the impact for individual customers. [2]
The investigation found no evidence of access to customer TiDB production data, command execution or persistence within the production environments it reviewed. This finding does not mean customer information in internal and support systems was unaffected. [2][3] Encrypted TiDB Cloud API keys were among the exposed material, but their encryption key was not exposed. Secrets included in support materials require a separate assessment. [2]
Timeline
Unauthorized-access window began
The investigation dated the earliest identified unauthorized activity to September 9.
[3]Activity detected
PingCAP began revoking credentials after detecting the activity.
[3]Identified access paths closed
PingCAP said all identified compromised credentials and access paths had been closed.
[3]Incident report published
The incident report described the scope and investigation.
[3]Briefing updated
This briefing was last reviewed and updated on October 24, 2026.
Threat Group & Attack Vector
A compromised GitHub account gave the attacker access to private repositories containing keys and Terraform state. Those credentials expanded access to Google Cloud, Jira and internal messaging. Support credentials enabled access to S3 diagnostic buckets, and data was exported from BigQuery. [2][3]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078.004 — Cloud Accounts: stolen credentials enabled access to cloud systems. [2]
- T1552 — Unsecured Credentials: secrets in repositories and configuration material enabled further access. [2]
Response
PingCAP revoked compromised credentials and investigated with NebuSec. Four additional vulnerabilities identified during the work were fixed and retested; investigators found no evidence that those flaws were exploited in this incident. [2][3] PingCAP advised rotating TiDB Cloud API keys and any credentials or secrets supplied through support channels. [1]