Reported by 3 outlets

Timeline

1. update from cyberpress.org

   659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer Records

   cyberpress.org · 55d ago · August 19th, 2026

   A threat actor has published a dataset containing allegedly live Stripe API keys for 659 merchant accounts, exposing data linked to 688,363 customers across 42 countries. The 35 GB archive was posted for free on a data-trading forum on August 18, 2026, rather than being offered for sale. The incident does not appear to involve a breach of Stripe’s own infrastructure. Instead, the available evidence indicates that attackers obtained secret API keys belonging to individual merchants and used them to retrieve data through Stripe’s legitimate API. The forum seller, using the handle “Satanic,” organized the stolen information into merchant-specific folders. The archive reportedly contains 17,654 files, including customer objects, charges, payment intents, checkout sessions, invoices, payouts, refunds, balance transactions, disputes, subscriptions, products, and pricing details. The data spans records dated from January 2022 to June 2026. Researchers who reviewed the dataset offline said its structure was consistent with authentic Stripe API output. They did not attempt to log in with the exposed keys, query Stripe’s live systems, or access merchant environments. Stripe Keys Expose 688K Of the 659 exposed keys, 650 were reportedly live secret keys beginning with sk_live , while nine were restricted keys. The dataset marked all keys as valid when the collector tested them. According to the archive’s metadata , 573 affected accounts could accept payments, 531 could make payouts, and

2. update from malware.news

   Analyzing Stripe Breach: Confirmed Vendor Exposure and Claims of 20,000 Compromised APIs

   malware.news · 55d ago · August 19th, 2026

   Analyzing Stripe Breach: Confirmed Vendor Exposure and Claims of 20,000 Compromised APIs On August 18th, 2026, a data release occurred on the illicit forum pwnforums. The threat actor known as Satanic published sensitive information extracted from hundreds of vendors utilizing the Stripe payment platform. Figure 1: The initial forum post by Satanic announcing the breach, detailing the compromise of databases and 1,033 API keys, totaling 33GB, along with millions of email matches. Satanic is a known entity within the cybercrime ecosystem, previously verified by Hudson Rock researchers for their involvement in large-scale breaches. We previously documented their activities in the Hot Topic breach . Figure 2: The pwnforums activity of ‘Satanic’, showing a history of high-profile database leaks, including the recent Hot Topic breach and the newly announced Stripe compromise. The Initial Release: A Glimpse into the Compromise The initial dump released on August 18th contained detailed information pertaining to 669 specific vendors, alongside 1,033 compromised API keys. The volume of the data is reported as 33GB. Hudson Rock researchers spoke to the threat actors minutes after the release of the data. During

3. update from gbhackers.com

   659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer Records

   gbhackers.com · 55d ago · August 19th, 2026

   The dataset […] The post 659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer Records appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .