Researchers theorize merchants’ secret keys had been compromised to enable access to 35 GB of data through ordinary API requests

An 18 August, 2026 data-trading forum post has exposed a cache of live Stripe API keys tied to 659 merchant accounts, with the resulting data linked to an estimated 688,363 customer records across 42 countries. The largest concentration of affected merchants was in the United States (212 accounts), followed by the United Kingdom (81) and France (57).

The post in Cyberpress has been analyzed to indicate that Stripe’s own infrastructure had not been breached: instead, the exposed data comes from merchants’ stolen secret keys used to pull data from each account with ordinary API requests, rather than exploiting a vulnerability in Stripe’s core systems. Possible sources for the exposed keys include infostealer logs, keys committed to public repositories, exposed .env files, misconfigured backups, and CI/CD logs. However, no infostealer infections have been tied to the specific vendor domains involved.

The archive totals about 35 GB in size and spans 17,654 files that include customer records, charges, payment intents, invoices, payouts, refunds, and balance transactions dated from January 2022 through June 2026. Of the 659 credentials in the set, 650 were live secret keys beginning with the “sk_live” prefix, and 519 accounts could both accept payments and make payouts, which raises the risk of direct financial abuse.

Researchers have noted that a separate release by the same threat actor (identified as “Satanic”) had targeted hundreds of Stripe vendors and came with claims of roughly 20,000 compromised API keys to be dribbled out in later batches.

Some researchers theorize the attacker may instead have used automated bots to find publicly exposed environment variables and other weakly secured secrets. Others have showed that a single active key could be used to access a merchant’s customer list, create a fraudulent payment link, and make a test charge within 17 hours.

Businesses using Stripe have been advised to rotate all live secret keys immediately, review API activity logs, verify payout bank details, and replace broad keys with restricted keys that only allow the functions actually needed.