Over 50,000 Stripe API keys leaked in public code

According to Security Affairs, Ransomnews researchers have recorded a large-scale Stripe merchant API key leak incident, with keys exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, identifying over 50,000 unique keys in total. Sample tests show that a significant portion is still active, allowing attackers to commit fraud within hours.

The report states that on August 18, 2026, a data trading forum released a dataset containing valid Stripe API keys for 659 merchant accounts and approximately 35 GB of customer and payment data. Ransomnews has conducted offline analysis and reported it to Stripe before publication. Stripe itself was not breached; the keys belong to the merchants. Researchers were able to access merchant customer lists, create fraudulent payment links, and complete a $1 test charge within 17 hours after discovering valid keys.

Valid keys can list customers and stored payment methods, create charges and payment intents, initiate refunds to attacker-controlled accounts, modify webhook endpoints to intercept payment notifications, and access associated accounts when Stripe Connect is enabled. The main sources of the leak include hardcoded keys in GitHub repositories and unignored .env files, unmasked environment variables in GitHub Actions build logs, and about 12% of over 3,000 misconfigured servers containing usable keys.