A Note from Our CEO on the PingCAP Security Incident

Max Liu, Co-founder and CEO, PingCAP | Published: October 23, 2026

As part of our commitment to transparency, I want to provide our customers and partners with a direct update on a recent security incident affecting our PingCAP systems.

Between September 9 and October 7, 2026, an unauthorized party used compromised credentials to access PingCAP’s internal systems and copy information from them, including information our customers entrusted to us.

We did not protect that information as we should have. I’m sorry for the exposure itself, for the work it has created for your teams, and for the concern it has caused the people whose information was involved. This happened on my watch. I take responsibility for it, and for fixing it.

We take this incident seriously and engaged with multiple cybersecurity firms to conduct independent investigations. NebuSec has completed its investigation and published its findings here. In short:

The scope and types of data exposure described in NebuSec’s report vary by customer. Please contact the PingCAP team for an assessment of the impact on your organization.

We are determining customer-specific impact and will contact affected customers directly. Please follow these steps now rather than waiting for an individual notice.

Internal systems that hold customer information must meet the same security standard as production. Every credential must have an owner and only the access it needs. Unusual access and large data movements must be detected and acted on. NebuSec’s report describes the containment and hardening work completed so far, and that work continues.

If you have questions, contact our security team at security@pingcap.com. Please do not include passwords, tokens, keys or other secrets. Our incident report remains the reference for this incident.