PingCAP / TiDB Cloud security incident (Sept 9 to Oct 7, 2026): source code and encrypted API keys stolen. Do I need to rotate my TiDB Cloud API keys?

What happened: PingCAP says an unauthorized party used stolen service-account credentials to reach some internal systems between September 9 and October 7, 2026. They copied source code and records, including customer contact and organization details, project metadata, SQL editor text and errors, billing and contract data, and encrypted TiDB Cloud API-key values. PingCAP detected it on October 7, disabled the credentials, and says all identified compromised credentials were invalidated by October 14. It reports no evidence that data stored in customers' TiDB databases was affected, and no evidence so far that the encrypted keys were decrypted or used. Am I affected? Any TiDB Cloud organization with management API keys created before October 2026. Also consider anything you typed into the TiDB Cloud SQL editor as possibly exposed (queries, and any secrets pasted into them). What to do (PingCAP's recommendations plus basics): 1. Organization owners: create new TiDB Cloud API keys, update every app, CI job, Terraform provider and script that uses them, check they work, then revoke the old keys. 2. Revoke immediately any key showing signs of misuse and contact PingCAP security. 3. If you ever pasted passwords, connection strings or tokens into the SQL editor, rotate those too. 4. Warn your team about targeted phishing: the stolen contact and billing data can be used for convincing fake 'urgent account' emails. Verify requests through known channels. 5. Review TiDB Cloud audit logs and organization members for changes you didn't make. After: confirm old keys fail, and that the new ones are in a secret manager rather than code. Sources: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ https://www.pingcap.com/trust-hub/security/customer-actions-october-2026/ https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html