Press play to start listening
On 18 August 2026, a threat actor known as “Satanic” uploaded thousands of allegedly stolen Stripe-related files to the cybercrime forum PwnForums. Previously linked to data leaks involving ClickFunnels, WooCommerce, Magento, and other platforms, Satanic released a database totalling slightly more than 33GB.
Hackread.com’s analysis identified 669 merchant account folders and 1,033 exposed Stripe API keys within the files. Many carried the sk_live_ prefix used for Stripe’s live payment environment, although Hackread.com did not test the keys against merchant accounts. Satanic also claimed to possess roughly 20,000 compromised Stripe API keys, but that larger figure has not been independently verified.
The available evidence does not indicate that Stripe itself was breached. The exposed credentials belonged to individual merchants. After removing duplicate entries and excluding folders associated with generic email providers such as Gmail, Hackread.com identified 323 unique business domains in the leaked data.
How Hackers Reach Sensitive Files
The leaked data appears to have been collected through exposed merchant credentials. A live secret Stripe API key, identified by the sk_live_ prefix, provides broad programmatic access to a merchant account, while rk_live_ keys carry restricted permissions.
Credentials can leak when developers hardcode them in public GitHub repositories, expose them through unmasked GitHub Actions logs, leave configuration files publicly accessible, or lose them through infostealer malware and poorly protected backups.
Infostealer malware, which can steal files, browser data, and developer credentials from infected computers, is one possible source of the exposed keys. Hackread.com’s analysis could not determine how the credentials were obtained. Hudson Rock said its analysis found no infostealer infections associated with the vendor domains it examined.
The company suggested that automated tools may have scanned for publicly accessible .env files or debug logs containing plaintext keys, while shared hosting or deployment infrastructure was another possible source.
Stolen Data and Potential Financial Loss
Hackread.com’s analysis identified 688,363 customer records in the released files. Metadata within the dataset indicated that 519 merchant accounts could both accept payments and send payouts. If the exposed keys remain active, their account access could create financial and privacy risks for merchants and customers.
The JSON and CSV files contained:
- Customer names, email addresses, phone numbers and physical addresses.
- Partial payment card details, including the final four digits, brand and expiry date.
- Purchase histories, billing amounts and paid invoices exceeding $5 million for one merchant account.
- Customer IP addresses recorded during purchases and internal transaction identifiers.
- Vendor discount codes listed as active, including high-value promotions intended for limited use.
The harm depends on the key type, the merchant account’s capabilities, and whether the credential remains active. An exposed live secret key could allow an attacker to read customer records, create fraudulent payment links and charges, issue unauthorized refunds, misuse discount codes, or change payout settings.
The dataset does not confirm that every key still works, since merchants may have rotated or revoked them. Stripe merchants should review API activity and payout details, rotate exposed keys, search repositories and CI logs for leaked credentials, and replace broad secret keys with restricted keys carrying only the permissions required by each integration.
