Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection
Between September 9 and October 7, 2026, an unauthorized party used a compromised GitHub account and exposed cloud credentials to copy PingCAP source code and internal analytics, storage and support records. NebuSec led the independent investigation and found no evidence of command execution, persistence, or access to data in customer TiDB databases. This report covers the intrusion, the exposed data, containment, recommended actions and indicators of compromise.
