Leak Exposes Stripe Vendor Records and API Keys; Actor Claims 20,000 Keys
Summary
Researchers analyzed a Satanic forum release containing data tied to 669 Stripe vendors and 1,033 API keys; the actor claims to hold about 20,000 keys. The dump includes customer and transaction records. The access method remains unconfirmed.
Key points
- A threat actor known as Satanic published a 33GB breach claim on August 18; the linked archive was 2.37GB.
- The initial release reportedly contains data for 669 vendors and 1,033 API keys; researchers identified 323 business domains after excluding generic email accounts.
- Leaked records include customer names, emails, phone numbers, home addresses, IP addresses, purchase histories, and invoice details; some invoices reveal the last four card digits.
- Some exposed live API keys reportedly have charge capabilities, which could enable unauthorized account actions or transactions, depending on permissions.
- Researchers found no infostealer infections associated with the observed vendor domains; exposed environment files or shared infrastructure are proposed, unconfirmed possibilities.
- The researchers advise Stripe users to review API-key security, audit environment variables, and monitor for anomalous activity.
Article Details
- Victim Organization
- Multiple vendors utilizing Stripe
- Incident Type
- Confirmed exposure of vendor customer, transaction, and operational data, including live API keys; the attack vector remains unconfirmed.
- Disclosure Date
- 2026-08-19
- Data Types Exposed
- Customer names, email addresses, phone numbers, and home addresses
- Purchaser IP addresses and purchase histories
- Customer, account, balance, charge, payout, and invoice records
- Descriptions of purchased services and links to hosted Stripe invoices
- Internal transaction IDs and third-party platform integration identifiers
- Last four digits of customer credit cards accessible through exposed invoices
- Live Stripe API keys, including standard keys associated with accounts having charge capabilities enabled
- Internal promotional codes, discount amounts, and durations
- Affected Records
- The initial release reportedly contained 669 vendor database folders and 1,033 compromised API keys. Researchers identified 323 unique business domains after excluding generic email-provider entries. One vendor account contained over 22,000 customers and more than $5 million in paid invoices. Satanic claimed possession of approximately 20,000 compromised Stripe API keys; that larger total was not independently confirmed.
- Affected Data Size
- Satanic advertised 33GB of data; the archive available through the initial download link was 2.37GB.
- Operational Impact
- Exposure of customer data and live API keys was confirmed by the source's analysis. No actual service disruption, unauthorized refunds, payment rerouting, or promotional-code abuse was reported. The source described these as potential consequences, dependent in part on key permissions.
- Ransom Or Extortion
- Satanic released data publicly on August 18, 2026, and threatened subsequent releases of additional API keys. A ransom demand was not disclosed.
- Claim Status
- confirmed
Threat Actors
Vendors
Products
Industries
ConsultingThe variety of businesses affected is vast, ranging from small consultancies to large e-commerce operations across multiple currencies and jurisdictions.E-commerceThe variety of businesses affected is vast, ranging from small consultancies to large e-commerce operations across multiple currencies and jurisdictions.