PingCAP, which makes the TiDB database, said an unauthorized party used stolen service account credentials to enter its internal systems between Sept. 9 and Oct. 7, 2026. These are logins that software, not a person, uses. The party copied data and took source code. PingCAP learned of it on Oct. 7 and began disabling credentials that day. By Oct. 14, it said, every compromised one it had identified was invalid.
An outside firm found no sign that the attacker ran commands or kept lasting access in the systems it reviewed, PingCAP said. Nothing found so far points to harm to data held in TiDB, and the investigation continues. Dark Reading reported that the exposed records include billing data, contract terms, pricing, email addresses, SQL editor text, and a table of encrypted API keys. Investigators said the encryption kept those keys from misuse. Dark Reading says a group called FulcrumSec appears to be behind the attack. The group claims to hold more, including Jira tickets and a four-year log of customer connections. PingCAP did not answer Dark Reading's request for comment.
A vendor's records about its customers are a separate target from the customers' own databases. Dark Reading says that information alone may be enough to cause serious problems. Buyers can ask which secrets and queries they send to vendor-hosted tools, and how fast they can rotate keys.