Hundreds of live Stripe merchant keys got dumped for free on a data-trading forum on August 18. The stash is about 35 GB of customer and payment information pulled from 659 merchant accounts, and it lands on roughly 688,000 people. Stripe’s own systems were not breached. The keys left merchant shops, got tested, and then got used the way any authorized app would use them.

The person posting the dump claimed Stripe itself had been hacked. That is not what happened. RansomNews examined the material offline and told Stripe before the story went out. They found that someone acquired merchants’ secret API keys, confirmed they were live, and made ordinary API requests to vacuum up whatever each account would give them. The archive was posted free, not even sold.

What was in the dump

Of the 659 validated credentials, 650 were live secret keys and nine were restricted keys. Each merchant folder reportedly held up to 27 resource types. That is not a password list. That is the working guts of an online store.

• Customer records
• Charges and payment intents
• Invoices, refunds, and disputes
• Subscriptions
• Payouts and balance transactions
• Products

The data looked real because it matched Stripe’s usual object formats. Production checkout sessions used the cs_live_ prefix. Account identifiers followed acct_. Those details are hard to fake well, which is why researchers treated the dump as credible.

A secret key is a skeleton key, not a login

A Stripe secret API key is not a sign-in code you type once and forget. It can give software-level access to an account. With it, someone can read customer information, create charges, issue refunds, and change where payouts go. That last part is the one that should make a shop owner sit up straight.

The collector’s records showed 519 of those accounts could both take payments and send payouts. That is a straight line from a stolen key to missing money. Redirect the bank details, wait for the next payout, and the cash walks. No malware. No fancy exploit. Just a key that should have stayed in a vault.

Where the keys likely came from

This is not a malware outbreak and it is not a hole in Stripe. Stolen keys tend to come from the usual mess: infostealer logs, public code repositories, exposed environment files, or backups that were never locked down. One lost secret becomes a large-scale account takeover because the key still works and nobody rotated it.

Customer data in a dump like this is fuel for fraud and social engineering. It also shows why the infostealer credential trade keeps paying off. A quietly stolen developer secret turns into access to a real commercial system. Regular people who bought something from one of these shops now have their records sitting in a 35 GB pile that anyone on that forum could grab.

That pisses me off. Small businesses run on Stripe because it just works. Customers trust the checkout page. Then a .env file gets committed, or a laptop gets scraped, and suddenly 688,000 people are in the blast radius. The payment provider was not the weak point. The keys escaped from merchant environments, got checked, and got used at scale.

What to do if you take Stripe payments

Do not wait for a public notice with your business name on it. The report withheld merchant names, domains, account IDs, and key material on purpose. Publishing that list would have been a shopping catalog for anyone still holding a working key.

If you run a Stripe account, treat this as a fire drill:

• Rotate every live secret key in the Stripe dashboard. Do it now, not after lunch.
• Check the security history for API requests you cannot explain.
• Inspect payout settings and bank details. Redirected payouts are the fast path to stolen funds.
• Replace broad secret keys with restricted keys that only have the permissions that integration actually needs.
• Put IP-based access policies on those keys where you can, so a stolen credential is useless from some random box in another country.
• Hunt for secrets in repositories, container images, CI logs, backup stores, and environment files. A public .env file is still how a lot of this starts.
• Turn on automated secret scanning, keep keys in a vault, and rotate on a schedule instead of waiting for a forum post.

If you bought something from an online shop and you are wondering whether you are in that 688,000, watch your statements and treat unexpected refunds, charges, or “verify your payment” emails as hostile until proven otherwise. The businesses should be the ones cleaning this up. You should not have to.

The lesson is not complicated. Keep the keys off the public internet. Scope them tight. Watch the payout destination like you would watch the cash drawer. That is the whole job.

Primary Source: https://cybersecuritynews.com/hundreds-of-leaked-stripe-merchant-keys/