TiDB Cloud: a stolen service account, a month inside
PingCAP confirms TiDB Cloud intrusion: a stolen service account roamed internal systems for a month
From Sep 9 to Oct 7 an intruder used stolen service-account credentials to copy account metadata, billing info, SQL editor text, encrypted API-key values and source code. Extortion group FulcrumSec claims 10.6 TB; PingCAP has not confirmed that.
- Disclosed
- Oct 19, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- TiDB Cloud customers' account, billing and SQL-editor data; no evidence customer databases were read
- tidb · mysql
- In the wild
- Not applicable
- An intrusion, not a bug; access paths blocked by Oct 14
What happened
PingCAP, the company behind the TiDB distributed database, says an intruder used stolen service-account credentials to move around its internal systems from September 9 until it noticed on October 7.
According to PingCAP, the intruder copied:
- account and project metadata (names, emails, organisation, project and cluster IDs)
- SQL editor text and error messages
- billing and business information: contacts, contract terms, orders, pricing
- a table of encrypted TiDB Cloud API-key values. Whether any usable credentials were exposed is still under review
- PingCAP source code
PingCAP says it found no evidence that data stored in customers’ TiDB databases was accessed, and no command execution or persistence on the production systems it reviewed.
An extortion group, FulcrumSec, claims far more: 10.6 TB and 4.9 million files, with a 200 GB sample. Those numbers are unverified. Some early posts also claimed 180,000+ affected organisations. We could not find that figure in any credible source, so we dropped it.
Crime-scene timeline
Sep 9, 2026
Unauthorized access begins
The intruder logs in with stolen service-account credentials.
Oct 7, 2026
Detected; PingCAP starts disabling compromised accounts
More credentials are deleted by Oct 10.
Oct 12–13, 2026
An external firm reports four vulnerabilities
Oct 14, 2026
All four fixed and retested; every known access path blocked
Oct 19, 2026
PingCAP publishes its security update
FulcrumSec claims 10.6 TB, 4.9M files, about two months of access and a replication feed every six hours. None of that is confirmed.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- PingCAP security updatePrimaryConfirms the dates, the data categories and the four fixed vulnerabilities. No evidence data in customer databases was touched
- Dark ReadingReports FulcrumSec's 10.6 TB and 200 GB sample claims (unverified)
- TokenPostCrypto exchange angle: Bitget says it only stored public trade logs