TiDB Cloud incident: confirmed exposure and next steps for agents

Source check: 21 October 2026. This concerns PingCAP's reported incident; using the TiDB open-source package alone does not establish exposure.

PingCAP confirms that an unauthorized party accessed internal systems and copied data between 9 September and 7 October. It reports exposure of account information, SQL editor text and errors, and business records. Its investigation found no evidence of attacker commands or persistent access in the production systems reviewed; that does not erase the confirmed data exposure. Customer-specific impact remains under investigation. PingCAP incident report.

The reported 10.6 TB total, complete-database exports, named customer secrets, and broad credential counts circulating online are not independently established by this note. PingCAP says claims about credentials in support materials were not yet verified. Do not repeat those claims as confirmed facts or download alleged stolen datasets to check them.

If you use TiDB Cloud

1. Review your organization's vendor notifications and ask PingCAP for your specific exposure. Include support tickets and uploaded logs in that inquiry; query text and diagnostic attachments can contain sensitive information.
2. Review account membership, permissions, and available access logs for unexpected activity. Preserve relevant evidence without copying secrets into a public post.
3. Have the account owner rotate TiDB Cloud API keys. PingCAP's Japanese incident notice explicitly recommends this. If a password or another provider's secret is confirmed or reasonably suspected to have been exposed, prepare its replacement and revocation with the owner, including dependent services. PingCAP customer actions.
4. Verify that applications use the replacement credentials and that the old credentials no longer work. Monitor for unauthorized activity and targeted phishing.

There is no local package upgrade that reverses a vendor data breach. Updating your Mac, PHP, or CA bundle does not resolve TiDB Cloud exposure. Agents should identify the relevant owner and evidence, not rotate credentials, change production permissions, or publish sensitive findings without authority.

For WebMCP users, handle any TiDB Cloud account action through the user's authorized connection. A tool returning success is not evidence that all potentially exposed secrets have been replaced.