preferred on
Points of Focus
- 659 Stripe merchant API credentials were exposed in the leak.
- Researchers found 688,363 customer records across 42 countries.
- Evidence points to merchant credential compromise, not a Stripe breach.
A dataset containing API credentials for 659 Stripe merchant accounts and records linked to more than 688,000 customers has been published on a cybercrime forum, but researchers say the incident did not originate from a breach of Stripe’s infrastructure.
Security researchers at Ransomnews analyzed the roughly 35 GB dataset, which appeared online on Aug. 18 and contains 17,654 files covering merchants across 42 countries. The largest concentrations were in the United States with 212 affected merchant accounts, followed by the United Kingdom with 81, France with 57, Canada with 38 and Brazil with 30.
The records span January 2022 through June 2026 and contain Stripe API objects including customers, charges, payment intents, invoices, checkout sessions, payouts, refunds and disputes.
Ransomnews: API Keys From 659 Stripe Merchants Leaked Alongside 688,000 Customer Records
According to Ransomnews, a dataset published on a data-trading forum contained API keys tied to 659 Stripe merchant accounts, along with roughly 35GB of customer and payment data covering… pic.twitter.com/32svUbuQ8v
— Wu Blockchain (@WuBlockchain) August 24, 2026
No full payment-card numbers were found. Stripe tokenizes card information, and the exposed records instead contained fields such as card brand, expiry date and last four digits.
650 exposed credentials were full Stripe secret keys
The more serious part of the leak is the credentials bundled with the merchant data.
Ransomnews found 650 live-mode secret keys and nine restricted keys. Metadata created by whoever collected the information marked all 659 credentials as valid at the time they were harvested.
The collector’s records indicated that 573 accounts could accept payments, 531 could make payouts and 519 could perform both functions. Ransomnews did not test the credentials against Stripe itself, meaning their current validity has not been independently confirmed.
That level of access can be significant.
Stripe’s own documentation says a live secret key can, by default, authenticate unrestricted API requests on behalf of an account. Stripe specifically warns developers never to expose secret keys in source code, public repositories or client-side applications because anyone possessing one can make API calls as the merchant.
Restricted keys offer narrower permissions determined by the merchant, reducing the damage possible if a credential is compromised. Only nine credentials in the leaked dataset were of that type.
Stripe itself was not the source of the breach
The dataset was initially advertised on the forum as a Stripe breach. The available evidence does not support that description.
Ransomnews said nothing it examined indicated Stripe’s central systems had been compromised. Instead, individual merchants appear to have lost control of their own API credentials, after which the credentials were apparently used to systematically retrieve information available through Stripe’s legitimate APIs.
The precise source of every key is unknown.
Possible routes include infostealer malware on developer computers, secret keys accidentally committed to public code repositories, exposed environment files and misconfigured backups. The dataset itself does not establish which method was responsible for individual merchants.
The person who posted the archive, using the alias “Satanic,” released it as a free download rather than offering it for sale. Ransomnews said the account had previously posted leaked databases and credential collections.
688,363 customer records leave merchants facing the cleanup
Researchers counted 688,363 customer records across the affected accounts.
While the absence of full card numbers limits one form of direct payment-card fraud, compromised API credentials create different risks. Depending on permissions, an attacker could potentially inspect customer information, manipulate payment workflows, issue refunds or alter account-level integrations.
Stripe recommends rotating exposed secret keys, reviewing API activity and replacing unrestricted credentials with narrowly scoped restricted keys where possible. The company also supports IP restrictions that limit where credentials can be used.
The incident highlights a security weakness outside Stripe’s own perimeter: payment infrastructure can remain uncompromised while merchants accidentally expose credentials powerful enough to make legitimate APIs behave like an extraction tool.
For the 688,000 customers represented in the archive, that technical difference does not erase the privacy exposure. But it changes where responsibility for the breach appears to begin: not with Stripe being hacked, but with hundreds of merchant credentials escaping into the hands of someone prepared to use them at scale.
Share
Most read articles
