PingCAP discloses TiDB Cloud control-plane breach, urges all customers to rotate API keys
PingCAP told all TiDB Cloud customers on October 20 to immediately rotate management API keys after its October 19 report admitted an intruder used stolen service-account credentials to enter internal systems from September 9 to October 7, discovered on October 7. Leaked data includes usernames and emails, SQL-editor queries and errors, customer contacts, contracts, pricing and billing settings, plus an encrypted API-key table; a Japanese notice on October 21 added support ticket data. Customer business data lives in a separate layer and was not exposed. It matters because control-plane access can be parlayed into broader account takeover, making key rotation urgent.
SOURCES
- 宝玉 (Baoyu)2026-10-21 22:15