--- title: "PingCAP internal-systems credential compromise" description: "PingCAP disclosed stolen credentials, copied internal data and source code, and exposure involving customer support materials." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-24" canonical_url: "https://www.ally.security/incidents/pingcap-internal-systems-credential-compromise-2026" markdown_url: "https://www.ally.security/incidents/pingcap-internal-systems-credential-compromise-2026.md" stix_url: "https://www.ally.security/incidents/pingcap-internal-systems-credential-compromise-2026/stix.json" --- # PingCAP internal-systems credential compromise A compromised GitHub account led to credentials that expanded access across internal cloud and support systems. Last modified Oct 24, 2026 · 3 sources ## Summary - **Environment:** GitHub, Google Cloud, internal collaboration systems and customer-support storage - **Operational impact:** Internal data and source code copied; customer-specific exposure still under review - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [PingCAP](https://www.pingcap.com/) reported unauthorized access to internal systems from September 9 through October 7, 2026. It detected the activity on October 7 and said all identified compromised credentials and access paths had been closed by October 14. [3](#source-3) ## Impact Copied information included account and organization data, SQL editor history, business and billing records, support materials, internal chat and employee information. PingCAP was still determining the impact for individual customers. [2](#source-2) The investigation found no evidence of access to customer TiDB production data, command execution or persistence within the production environments it reviewed. This finding does not mean customer information in internal and support systems was unaffected. [2](#source-2) [3](#source-3) Encrypted TiDB Cloud API keys were among the exposed material, but their encryption key was not exposed. Secrets included in support materials require a separate assessment. [2](#source-2) ## Timeline ### September 9, 2026 — Unauthorized-access window began The investigation dated the earliest identified unauthorized activity to September 9. [3](#source-3) ### October 7, 2026 — Activity detected PingCAP began revoking credentials after detecting the activity. [3](#source-3) ### October 14, 2026 — Identified access paths closed PingCAP said all identified compromised credentials and access paths had been closed. [3](#source-3) ### October 19, 2026 — Incident report published The [incident report](https://www.pingcap.com/trust-hub/security/security-update-october-2026/) described the scope and investigation. [3](#source-3) ### October 23, 2026 — Customer rotation guidance reinforced The [CEO note](https://www.pingcap.com/trust-hub/security/ceo-note-october-2026/) urged customers to rotate keys and secrets shared through support without waiting for individual notification. [1](#source-1) ### October 24, 2026 — Briefing updated This briefing was last reviewed and updated on October 24, 2026. ## Threat Group & Attack Vector A compromised GitHub account gave the attacker access to private repositories containing keys and Terraform state. Those credentials expanded access to Google Cloud, Jira and internal messaging. Support credentials enabled access to S3 diagnostic buckets, and data was exported from BigQuery. [2](#source-2) [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078.004 — Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/): stolen credentials enabled access to cloud systems. [2](#source-2) - [T1552 — Unsecured Credentials](https://attack.mitre.org/techniques/T1552/): secrets in repositories and configuration material enabled further access. [2](#source-2) ## Response PingCAP revoked compromised credentials and investigated with [NebuSec](https://nebusec.ai/). Four additional vulnerabilities identified during the work were fixed and retested; investigators found no evidence that those flaws were exploited in this incident. [2](#source-2) [3](#source-3) PingCAP advised rotating TiDB Cloud API keys and any credentials or secrets supplied through support channels. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### A Note from Our CEO on the PingCAP Security Incident official · PingCAP · Oct 23, 2026 ### Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection research · NebuSec · Oct 21, 2026 ### Security Incident Report: Unauthorized Access to PingCAP official · PingCAP · Oct 19, 2026
Evidence ledger Review the supporting structured claims. 1. **Used Attack Technique · 100% confidence · current** PingCAP internal-systems credential compromise: https://attack.mitre.org/techniques/T1552/ 2. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: The attacker used compromised Google Cloud service accounts to export BigQuery tables and download Cloud Storage objects; support-ticket credentials also enabled access to S3 diagnostic-data buckets. 3. **Occurred At · 100% confidence · current** Customer actions reiterated: 2026-10-23 4. **Disclosed At · 100% confidence · current** PingCAP internal-systems credential compromise: 2026-10-19 5. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Identified access paths closed 6. **Occurred At · 100% confidence · current** Security report published: 2026-10-19 7. **Ended At · 100% confidence · current** PingCAP internal-systems credential compromise: 2026-10-07 8. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Exported TiDB Cloud API-key values were encrypted and the encryption key was not exposed; this finding did not apply to usable credentials shared in support materials. 9. **Occurred At · 100% confidence · current** Incident detected and credential revocation began: 2026-10-07 10. **Discovered At · 100% confidence · current** PingCAP internal-systems credential compromise: 2026-10-07 11. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: NebuSec found no evidence of access to data stored in customer TiDB databases, attacker command execution or persistence in the production systems reviewed. 12. **Occurred At · 100% confidence · current** Identified access paths closed: 2026-10-14 13. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Customer actions reiterated 14. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Credential disabling began October 7; by October 14 identified compromised credentials and access paths were revoked or blocked. Four vulnerabilities found during proactive source-code review were fixed and retested, with no evidence of prior exploitation. 15. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: PingCAP urged customers to replace management API keys and rotate credentials or secrets previously shared with support, without waiting for individual notification. 16. **Used Attack Technique · 100% confidence · current** PingCAP internal-systems credential compromise: https://attack.mitre.org/techniques/T1078/004/ 17. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Copied records included account and organization information, SQL editor history, business and billing records, support materials, internal chat and employee information; customer-specific scope varied and remained under review. 18. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: NebuSec traced entry to a compromised GitHub account and keys exposed in private repositories and Terraform state; the attacker used those credentials to reach Google Cloud, Jira and internal messaging systems. 19. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Security report published 20. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: PingCAP reported unauthorized access and data copying from internal systems between September 9 and October 7, 2026, including source code and customer-related records. 21. **Began At · 100% confidence · current** PingCAP internal-systems credential compromise: 2026-09-09 22. **Affected Organization · 100% confidence · current** PingCAP internal-systems credential compromise: PingCAP 23. **Resulted In · 100% confidence · current** PingCAP internal-systems credential compromise: Incident detected and credential revocation began