Security Affairs Reports Massive Leak of Stripe Merchant API Keys

ChainCatcher, citing Security Affairs, reported a large-scale leak of Stripe merchant API keys. Ransomnews researchers said the exposed keys were found in public code repositories, GitHub Actions logs, and misconfigured web servers. The researchers identified more than 50,000 unique keys. Sample testing showed that a substantial portion was still active, and attackers could use them to commit fraud within hours. The report said that on Aug. 18, 2026, a data set posted on a data-trading forum included valid Stripe API keys for 659 merchant accounts, along with about 35 GB of customer and payment data. Ransomnews analyzed the data offline and reported it to Stripe before publication. The report said Stripe itself was not breached, and that the leaked keys belonged to merchants. Researchers said that after finding a valid key, they could access a merchant’s customer list, create fraudulent payment links, and complete a $1 test charge within 17 hours. According to the report, valid keys could also be used to list customers and stored payment methods, create charges and payment intents, send refunds to attacker-controlled accounts, modify webhook endpoints to intercept payment notifications, and access connected accounts when Stripe Connect was enabled. The main exposure sources included hardcoded keys and unignored .env files in GitHub repositories, unmasked environment variables in GitHub Actions build logs, and misconfigured servers. The report said roughly 12% of more than 3,000 misconfigured servers contained usable keys.