Massive Stripe API Key Exposure Puts Organizations at Risk

Executive Summary: 

A major data exposure involving vendors on the Stripe payment platform was disclosed on August 18, 2026, after a threat actor (SATANIC) published a dataset on an underground forum containing vendor databases, customer information, financial records, and live Stripe API keys spanning 662 databases and 1,033 compromised API keys, totaling approximately 33GB, and labeled as an initial batch (V1) with the actor separately claiming possession of ~20,000 keys overall. Based on direct analysis of the leaked dataset, 313 unique organizations were confirmed affected across 659 database entries and 688,363 summed customer records, with each organization's folder following a consistent structure indicating the data was extracted programmatically via the Stripe API rather than collected as raw database dumps. Exposed data includes customer records, invoices, transactions, balances, payouts, promotional codes, and API credentials  with some keys identified as live sk_live_ credentials with charge capabilities enabled, creating potential for unauthorized financial operations and broader account abuse.

🚨Was your organization exposed in the Stripe breach? Check now for free ⬇️

Key Takeaways: 

Incident Overview: 

On August 18, 2026, a threat actor operating under the alias "Satanic" published a forum listing titled "Stripe.com 662 Database's Breach + 1033 API Keys Compromised 33GB," captioned "a new day, new breach." The post was edited roughly 11 hours after initial publication to add a backup download link. The release archive is explicitly versioned as V1 (filename ST_STRIPE_V1.rar), consistent with the actor's framing of this as an initial installment rather than the full claimed dataset  raising the likelihood of subsequent V2/V3 releases if the ~20,000-key claim is accurate. 

The listing includes a validation sample ("Stripe_validation_summary") showing structured per-account fields: status, key hash, account ID, email, display name, business name, domain, country, default currency, and boolean flags for charges-enabled and payouts-enabled. Sample rows in the post show accounts marked "valid" with both charges and payouts enabled. 

The post also states aggregate figures of 6,160,954 total email matches and 1,350,336 unique emails across the dataset. These figures originate solely from the actor's own forum post and are treated in this report as unverified claims, not confirmed findings. 

The download archive associated with the release, ST_STRIPE_V1.rar, was recorded as created on 8/19/2026 with a file size of 1.6GB. This is notably smaller than both the 33GB figure advertised in the original forum post and consistent with a pattern of the actual downloadable material representing only a portion of the total claimed dataset. 

Organizations Affected: 

Direct review of the leaked directory listing (per-vendor folders, each tagged with domain, customer count, and outstanding balance/currency), conducted against the full ~33GB dataset, confirms: 

Dataset Structure (Per-Organization Folder Layout): 

Analysis of the leaked archive found that each affected organization's folder follows a consistent, standardized structure, mirroring core Stripe API object types. This uniformity across all 313+ organizations indicates the data was harvested through automated, scripted calls against the Stripe API using the compromised secret keys, rather than through a raw database export or file-system breach. Observed subfolders/files per organization: 

The presence of _expanded variants for both charges and customers is notable  expanded API calls pull in nested, related objects (e.g., full payment method details, linked invoices) rather than bare IDs, indicating the actor made deliberate, high-fidelity extraction calls rather than default/minimal API pulls. This increases the sensitivity of the exposed data beyond what a default Stripe API response would return. 

Scope and Type of Exposed Customer Data: 

The released material reportedly contains a broad range of customer and business information, including: 

• The exposure of promotional codes introduces an additional business risk: high-value discounts intended for limited groups (customers, employees, or VIP users) could be abused at scale, resulting in unauthorized discounts and revenue loss. 

Operational Impact: 

The most significant component of the exposure is the presence of live Stripe API credentials. A live Stripe secret key can provide programmatic access to a merchant environment depending on its permissions, including: 

Several accounts in the validation sample show both charges-enabled and payouts-enabled set to true, indicating broad financial access rather than restricted-scope credentials. Based on direct analysis, with 313 confirmed organizations, 659 database entries, and a standardized 17-object extraction footprint per organization, the operational blast radius spans a large and diverse merchant population with consistently deep data exposure  not a shallow or partial scrape. 

Investigating the Attack Vector: 

The exact source of the compromised credentials has not been conclusively established. Based on the pattern of this type of exposure, realistic candidates include: 

The diversity of affected vendors  313 organizations spanning different countries, currencies, and business types  makes a single shared application vulnerability unlikely, and instead points toward systematic scanning or collection of exposed credentials across many independent environments, followed by validation and automated, scripted extraction via the Stripe API (consistent with the standardized per-organization folder structure found during analysis). 

Targeted Country / Scope: 

The affected organizations span multiple countries, currencies, industries, and jurisdictions, with confirmed transactions in at least 12 distinct currencies (USD, EUR, GBP, CAD, MXN, BRL, SGD, NOK, PLN, SEK, HKD, RON). Affected vendors range from smaller consultancies to larger e-commerce operations, indicating the exposure was not restricted to a single geographic region or sector. 

MITRE TTP: 

Targeted Vulnerability: 

No specific CVE or software vulnerability has been identified in connection with this exposure. The primary weakness is the exposure and compromise of merchant-side Stripe secret API keys, not a confirmed vulnerability in Stripe's core platform. 

Recommended Security Actions: 

Security teams managing Stripe integrations should review environments and logs for: 

Any Stripe secret key discovered outside its intended protected environment should be treated as potentially compromised and rotated or revoked immediately. 

Conclusion: 

The forum listing describes an initial release  versioned V1 by the threat actor covering 662 vendor databases and 1,033 compromised Stripe API keys, totaling approximately 33GB. Based on direct analysis of the leaked dataset, 313+ unique organizations were confirmed affected across 659 database entries, with a combined 688,363 customer records, each following a standardized 17-folder Stripe API extraction structure (account, balance, balance_transactions, charges, charges_expanded, checkout_sessions, customers, customers_expanded, events, invoiceitems, invoices, payment_intents, prices, products, refunds, setup_intents, and _stats). The associated download archive was observed at only 1.6GB, reinforcing the possibility that the publicly available material represents a fraction of the actor's full claimed haul, with the V1 designation suggesting further releases (V2 and beyond) are plausible. The threat actor's broader claims of ~20,000 compromised API keys and 6.16 million email matches remain unverified. 

The exposed information includes sensitive customer records, transaction data, invoices, promotional codes, and live API credentials with charge and payout capabilities enabled on multiple accounts  creating meaningful potential for financial and operational abuse across a confirmed 313+-organization footprint with consistently deep, expanded-object data exposure. 

This incident underscores the importance of protecting secrets throughout the full development and deployment lifecycle: public repositories, environment files, build/debug logs, and infrastructure misconfigurations remain the most common sources of credential compromise. Organizations using Stripe should audit their API keys now, rotate anything potentially exposed, enforce least-privilege access, and monitor account activity for unauthorized transactions or configuration changes  independent of whether the threat actor's larger claims, or a future V2 release, are ever substantiated.