Leaked API keys expose 688,000 Stripe customer records across 42 countries

A threat actor posted a dataset containing live Stripe API keys for 659 merchant accounts on a data-trading forum on August 18, 2026, exposing data linked to an estimated 688,363 customer records across 42 countries. The incident does not appear to involve a breach of Stripe's own infrastructure but rather a mass exposure of merchant credentials.

Scale of the Exposure

The 35 GB archive, posted for free by a forum user operating under the alias "Satanic," contains 17,654 files spanning customer records, charges, payment intents, invoices, payouts, refunds, and balance transactions dated from January 2022 through June 2026. Of the 659 credentials, 650 were live secret keys beginning with the `sk_live` prefix, and 519 accounts could both accept payments and make payouts, raising the prospect of direct financial loss.cybersecuritynews+2

Separately, Hudson Rock researchers documented a related release by the same threat actor targeting hundreds of Stripe vendors, with claims of possessing approximately 20,000 compromised API keys to be released in subsequent batches. The initial dump contained data on 669 vendors and 1,033 API keys, with the threat actor telling researchers the release represented "only a fraction" of their total haul.infostealers

Attack Vector and Risk

Ransomnews, which analyzed the dataset offline and notified Stripe before publishing, confirmed that the forum listing misleadingly claimed Stripe itself had been hacked. Researchers found instead that someone acquired merchants' secret keys and used standard API requests to collect data from each account.securityaffairs+1

The likely sources of the exposed keys include infostealer logs from developer machines, keys committed to public code repositories, exposed `.env` files, misconfigured backups, and CI/CD logs. Hudson Rock's analysis found no infostealer infections tied to the specific vendor domains, suggesting the attacker may have used automated bots to scan for misconfigured, publicly exposed environment variables.gbhackers+2

Researchers demonstrated the severity by showing that a single active key allowed them to access a merchant's customer list, create a fraudulent payment link, and make a test charge within 17 hours.securityaffairs

Remediation

The largest share of impacted merchants was in the United States with 212 accounts, followed by the United Kingdom with 81 and France with 57. Affected businesses are advised to immediately rotate all live secret keys, review API activity logs, verify payout bank details, and replace broad secret keys with restricted keys scoped only to required functions. Stripe provides automatic secret scanning through GitHub's partner program, but researchers noted the opt-in rate remains low and coverage does not extend to build logs or misconfigured servers.cyberpress+3