659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer Records
Brief
A threat actor has published a dataset containing allegedly live Stripe API keys for 659 merchant accounts, exposing data linked to 688,363 customers across 42 countries.
The 35 GB archive was posted for free on a data-trading forum on August 18, 2026, rather than being offered for sale.
The incident does not appear to involve a breach of Stripe’s own infrastructure. Instead, the available evidence indicates that attackers obtained secret API keys belonging to individual merchants and used them to retrieve data through Stripe’s legitimate API.
The forum seller, using the handle “Satanic,” organized the stolen information into merchant-specific folders.
The archive reportedly contains 17,654 files, including customer objects, charges, payment intents, checkout sessions, invoices, payouts, refunds, balance transactions, disputes, subscriptions, products, and pricing details.