A dataset posted on a data-trading forum contained live Stripe API keys tied to 659 merchant accounts, exposing data associated with an estimated 688,363 customer records in 42 countries. The release was posted on August 18, 2026, by a forum user using the alias “Satanic.”

Available reporting indicates this was not a breach of Stripe’s own infrastructure. Instead, the incident appears to involve the widespread exposure of merchant credentials that could be used to access data through standard Stripe API requests.

Scope of the Stripe Merchant Key Exposure

The leaked archive was approximately 35 GB and included 17,654 files. Its contents covered customer records, charges, payment intents, invoices, payouts, refunds, and balance transactions dated from January 2022 through June 2026.

Of the 659 exposed credentials:

  • 650 were live secret keys beginning with the sk_live prefix.
  • 519 accounts could accept payments and send payouts.
  • The records were linked to merchants in 42 countries.

The United States accounted for the largest number of affected merchants, with 212 accounts. The United Kingdom had 81 accounts, while France had 57.

What the Leaked Stripe Keys Could Allow

Live secret keys can provide access to merchant account functions through Stripe’s API. Researchers showed that one active key could be used to access a merchant’s customer list, create a fraudulent payment link, and make a test charge within 17 hours.

Because 519 of the accounts in the dataset could both process payments and make payouts, the exposure raised the possibility of direct financial loss. The archive also included records related to financial activity, including charges, refunds, invoices, payouts, and balance transactions.

How Merchant Credentials May Have Been Exposed

The forum post claimed that Stripe itself had been hacked. However, Ransomnews analyzed the dataset offline, notified Stripe before publishing, and reported that the data appeared to come from exposed merchant secret keys rather than Stripe infrastructure.

Potential sources of exposed credentials include:

  • Infostealer logs from developer machines
  • Secret keys committed to public code repositories
  • Publicly exposed .env files
  • Misconfigured backups
  • CI/CD logs

Hudson Rock found no infostealer infections associated with the specific vendor domains in its analysis. That finding suggested the attacker may have used automated bots to search for publicly exposed or misconfigured environment variables.

Hudson Rock researchers documented a related release from the same threat actor involving hundreds of Stripe vendors. The initial release included data connected to 669 vendors and 1,033 API keys.

The threat actor claimed to hold about 20,000 compromised API keys and described the initial release as only a fraction of the total collection. Those claims concern possible future releases and do not change the reported scope of the initial dataset containing 659 merchant accounts.

Steps for Affected Stripe Merchants

Businesses that may be affected are advised to take immediate action:

  • Rotate all live secret keys.
  • Review API activity logs for unusual activity.
  • Verify payout bank details.
  • Replace broad secret keys with restricted keys limited to necessary functions.

Stripe offers automatic secret scanning through GitHub’s partner program. However, researchers noted that participation is opt-in and that this scanning does not cover build logs or misconfigured servers.