Hundreds of Leaked Stripe Merchant Keys Expose Sensitive Payment and Payout Capabilities

Hundreds of active Stripe merchant API keys have been leaked on a data-trading forum, exposing sensitive payment and payout capabilities for 659 accounts. The exposed data, totaling 35 GB and affecting approximately 688,000 individuals, includes customer records, charges, and transaction details. While Stripe's systems were not breached, the leaked keys, likely obtained via infostealers or code repositories, allow unauthorized access to financial operations and customer data.

The leak, discovered by RansomNews and reported to Stripe before publication, was posted freely on August 18th. The listing falsely claimed Stripe itself had been hacked. However, analysis revealed that attackers acquired merchants' secret API keys, tested their validity, and then used legitimate API requests to extract data accessible through those keys. Of the 659 validated credentials, 650 were live secret keys and nine were restricted keys.

Each compromised merchant account's data included up to 27 resource types, such as customer records, charges, payment intents, invoices, refunds, disputes, subscriptions, payouts, products, and balance transactions. A secret API key provides software-level access, enabling actions like reading customer information, creating charges, issuing refunds, and altering payout destinations. Crucially, records indicated that 519 accounts had the capability to both accept payments and initiate payouts, presenting a direct financial risk.

The authenticity of the data was further supported by its adherence to Stripe's standard object formats, with researchers identifying correct prefixes for account, customer, charge, payment-intent, and checkout-session records. The use of production checkout session formats like cs_live_ and account identifiers starting with acct_ are difficult to convincingly fabricate.

The implications extend beyond the affected businesses. Exposed customer information can be leveraged for fraud, social engineering attacks, and further account compromises. This incident underscores the persistent danger posed by the growing infostealer credential economy, where stolen developer secrets can grant attackers access to valuable commercial systems.

To mitigate such risks, merchants are strongly advised to rotate all live secret keys immediately via their account dashboard and meticulously review their security history for any unexplained API requests. Furthermore, a thorough inspection of payout settings and bank details is essential, as redirecting payouts represents a swift method for converting unauthorized access into stolen funds.

Beyond immediate remediation, businesses should implement stricter access controls. This includes replacing broad secret keys with restricted keys that grant only the necessary permissions for specific integrations. Where feasible, employing IP-based access policies can significantly limit the utility of a stolen credential when accessed from an attacker-controlled system.

Automated secret scanning, secure vaulting solutions, and regular key rotation are critical practices to reduce the likelihood of compromised credentials becoming an entry point for attackers. The core lesson remains: the vulnerability originated not from Stripe's platform, but from credentials escaping merchant environments and subsequently being exploited at scale. Prompt key rotation, tightly scoped access, and vigilant monitoring of payment and payout activities are the practical defenses against such incidents.