A threat actor has published a dataset containing allegedly live Stripe API keys for 659 merchant accounts, exposing data linked to 688,363 customers across 42 countries.
The 35 GB archive was posted for free on a data-trading forum on August 18, 2026, rather than being offered for sale.
The incident does not appear to involve a breach of Stripe’s own infrastructure. Instead, the available evidence indicates that attackers obtained secret API keys belonging to individual merchants and used them to retrieve data through Stripe’s legitimate API.
The forum seller, using the handle “Satanic,” organized the stolen information into merchant-specific folders.
The archive reportedly contains 17,654 files, including customer objects, charges, payment intents, checkout sessions, invoices, payouts, refunds, balance transactions, disputes, subscriptions, products, and pricing details. The data spans records dated from January 2022 to June 2026.
Researchers who reviewed the dataset offline said its structure was consistent with authentic Stripe API output. They did not attempt to log in with the exposed keys, query Stripe’s live systems, or access merchant environments.
Stripe Keys Expose 688K
Of the 659 exposed keys, 650 were reportedly live secret keys beginning with sk_live, while nine were restricted keys. The dataset marked all keys as valid when the collector tested them.
According to the archive’s metadata, 573 affected accounts could accept payments, 531 could make payouts, and 519 could do both. A Stripe secret key provides programmatic access, not just dashboard login access.
If it has broad permissions, an attacker may be able to read customer and transaction data, create charges, issue refunds, access payment-related objects, or modify payout settings.
This makes exposed keys especially dangerous for merchants that do not quickly rotate them. The dataset reportedly does not contain raw card numbers.
Payment card records are tokenized and include fields such as the last four digits, card brand, expiry date, funding type, issuing country, and fingerprint.
While this reduces direct card theft risk, the exposed data could still support targeted phishing, refund fraud, business email compromise, and payment-related social engineering.
The original source could not determine how the 659 keys were stolen. Possible exposure routes include infostealer infections on developer systems, API keys committed to public code repositories, exposed environment files, insecure backups, container images, and CI/CD logs.
Affected merchants may not know their credentials were exposed. Organizations using Stripe should immediately rotate all live secret keys, review API activity and security logs, verify payout bank details, and investigate unexpected refunds or charges, ransomnews said.
Merchants should also replace broad secret keys with restricted keys scoped only to required functions. Where available, access policies should limit which IP addresses can use API keys.
Security teams should scan source repositories, build logs, cloud storage, backup files, and deployment configurations for exposed sk_live values.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
