Stripe Customer Data Leaked via Compromised Merchant API Keys

A massive dataset allegedly containing sensitive information from Stripe customers has surfaced on a cybercrime forum, exposing the vulnerability of businesses that mishandle their programmatic access credentials. The leak underscores a growing trend of credential exposure where attackers bypass core infrastructure to target individual merchant accounts.

The leaked dataset, totaling approximately 35GB, contains business statistics and customer logs, including names, contact details, and addresses. According to researchers from Ransomnews, the data includes 659 individual merchant accounts and 659 compromised API keys. A detailed analysis of these keys revealed that 650 were live secret keys (sk_live_) and nine were restricted keys, all of which were verified as active at the time they were harvested.

The Root of the Exposure

Contrary to initial fears of a systemic failure, researchers indicate that the leak did not result from a direct breach of Stripe's core infrastructure. Instead, the data was gathered through compromised merchant API keys. This phenomenon, known as credential exposure, typically occurs when businesses accidentally leak secret keys in public code repositories or insecure source code, allowing malicious actors to programmatically access account data without needing to penetrate the primary service provider's security layers.

Industry Implications

The exposure of live secret API keys is a critical security failure. These keys grant programmatic access to Stripe accounts, which could potentially allow attackers to access sensitive customer data, create unauthorized charges, issue fraudulent refunds, or alter payout settings. Beyond direct financial manipulation, the combination of customer names, purchase histories, and contact information provides a blueprint for social engineering. Researchers noted that it is "super easy" for malicious actors to cross-reference this information to profile individuals and craft highly convincing phishing and scam campaigns.

Moving Forward

While the immediate leak is tied to merchant-side negligence, the incident serves as a warning for the broader fintech ecosystem. Businesses are urged to rotate their API keys immediately if they suspect exposure and to implement stricter secrets management practices to prevent keys from entering version control systems. It remains to be seen if further batches of compromised keys will surface, but the current leak confirms that the primary vector of attack is the endpoint, not the platform itself.