PingCAP TiDB Cloud Breach: PKCERT Tells Pakistan Customers to Rotate API Keys and Check Logs
PingCAP confirmed stolen credentials reached its systems from 9 September 2026. See what PKCERT advisory NCA-21 says, what was exposed and which keys to rotate.
PingCAP, the company behind the TiDB database and TiDB Cloud, has confirmed that stolen service-account credentials were used to get into its internal cloud systems between 9 September and 7 October 2026, and Pakistan's National CERT told customers on 21 October to rotate API keys and review logs. PingCAP has not confirmed that any customer database was touched.
If your company, software house or freelance client uses TiDB Cloud, this is a to-do item for today. If you do not, you can stop reading. We read the National CERT advisory NCA-21.211026 on 22 October 2026. PingCAP's own incident report was not available to us, so every PingCAP detail below is as the advisory quotes it.
The access began on 9 September and was found on 7 October
According to National CERT's summary of PingCAP's report dated 19 October, an attacker used stolen service-account credentials to reach certain internal systems from 9 September. PingCAP found the problem on 7 October, blocked known access paths by 14 October, and was still investigating on 19 October.
| Date (2026) | What happened, per the advisory |
|---|---|
| 9 September | First unauthorised access with stolen credentials |
| 7 October | Problem discovered, revoking of credentials begins |
| 10 October | More compromised credentials deleted |
| 14 October | Known access paths blocked |
| 19 October | Four vendor-side flaws fixed and retested, investigation continues |
| 21 October | National CERT advisory issued |
Names, emails, contracts and some SQL text were exposed, but no database contents are confirmed
The advisory lists exposed items as usernames, email addresses, organisation and project links, SQL editor text, errors, customer contacts, contracts, orders, pricing and billing settings. Encrypted API-key values were exported and source code was taken. No data stored inside TiDB databases is confirmed affected.
That last point comes with a warning. The advisory says the lack of evidence does not prove that every customer or category was spared. It also says PingCAP's Japanese-language notice mentions personal information of up to about 50,000 people in Japan.
Customers should rotate keys and passwords, not wait for a patch
The advisory says there is no universal software patch, because the entry point was stolen credentials and not a TiDB engine bug. It asks customers to replace TiDB Cloud management API keys, database passwords, certificates and cloud storage tokens saved in the console or SQL editor history.
- Create new TiDB Cloud management API keys, update your apps and CI/CD, then revoke the old keys.
- Review Data Service API keys separately.
- Rotate database user passwords and TLS certificates.
- Rotate any AWS S3, Google Cloud or Azure storage credentials used for backups or imports.
- Check logs from 9 September 2026 onward for odd logins and key changes.
Expect phishing that pretends to be PingCAP
The advisory lists impersonation of PingCAP staff, spear-phishing and vendor impersonation as likely follow-on risks, because contact lists and contracts were exposed. Verify any message about your account by logging in directly, never through a link in an email.
Tell your finance and support teams as well as developers. A fake invoice or "account verification" mail aimed at the person who signed the contract is the realistic attack. The habits in PKCERT's five checks before paying online apply here too.
What is still unknown
The advisory says PingCAP has not published technical root causes or customer patches for the four vendor-side flaws it fixed, has not given CVE numbers, and has not published attacker indicators. Customer-specific impact is still being assessed.
If you find unauthorised activity, preserve logs, activate your incident process and contact PingCAP for your own exposure. In Pakistan, you can report it through PKCERT or NCCIA.
Only TiDB Cloud customers need to act, and the first hour matters most
If your organisation does not use TiDB Cloud or other PingCAP services, the advisory gives you nothing to do. If it does, spend the first hour on the management API keys and on the people who can approve a change, then work through the rest of the list the same day.
Start by asking who in your company created a TiDB Cloud account. In small Pakistani software houses this is often one developer who left, or a freelancer who set up the first project. Their email address may still be listed as an owner. Remove people who no longer need access and turn on single sign-on or multi-factor login where the console supports it, as the advisory suggests.
Next, find where the keys are used. A key may sit in a deployment pipeline, a backup script, a data import job or a developer's laptop. Replace each place before you revoke the old key, so nothing stops working. After rotation, write a short note of what was changed and when. If the vendor later finds that your project was affected, that note saves hours.
Common questions about the PingCAP incident
What is TiDB Cloud?
It is PingCAP's hosted database service. The advisory says it is used by government, critical infrastructure, financial and other organisations.
Was my database data stolen?
Not confirmed. The advisory says no evidence was identified of data stored in TiDB being affected, but that does not prove every customer was spared.
Do I need to install a patch?
No universal patch exists. The advisory asks for key and credential rotation and a log review.
How far back should I check logs?
From 9 September 2026 onward, and earlier where you can, as the advisory states.
Where do I report an incident in Pakistan?
To National CERT at cert@pkcert.gov.pk or through its incident portal.
How we verified this
What we checked, where we read it, and what we could not confirm.
Last checked 22 October 2026. We read National CERT's advisory NCA-21.211026, which states a threat intelligence update date of 21 October 2026, and the list at pkcert.gov.pk/advisories. We could not open PingCAP's incident report or status page, so its dates and wording are as the advisory reports them. We have not verified whether any Pakistani company was affected.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
