Dataset allegedly tied to Stripe customers surfaces on cybercrime forum

A dataset allegedly linked to customers of Stripe, the American fintech company that processes payments for millions of businesses, has appeared for sale on a cybercrime forum, exposing business records, customer information and transaction data tied to companies that use the payment platform.

A threat actor is offering roughly 35GB of data said to contain logs revealing details about businesses that rely on Stripe to manage payments. The listed material reportedly includes shop-level statistics such as customer counts, transaction volumes and processed payment totals, along with account records containing emails, Stripe API keys and account flags. Product logs, customer records and coupon codes are also said to be included in the package.

Cybernews researchers who reviewed the claims said the threat actor has operated for an extended period and that the material examined so far appears legitimate. The overall size of the dataset was said to be broadly consistent with the 35GB the seller claims to possess.

Hudson Rock, a cybersecurity firm that also examined the listing, said the dataset contained 669 distinct vendors and 1,033 compromised API keys. Hudson Rock researchers said they contacted the threat actor shortly after the data was posted, and the actor claimed the released material represents only a fraction of a larger collection. The actor told researchers they hold approximately 20,000 compromised Stripe API keys and plan to release additional batches over time.

The exposed information is said to span records from numerous businesses that use Stripe rather than being limited to data belonging to Stripe itself. Customer records within the dataset reportedly include full names and contact information, with addresses included in some cases. Those individuals can also be tied to user IDs referenced in transaction logs, a linkage that researchers said could make the data considerably more useful to criminals than a basic list of names and email addresses. By connecting customers to specific products, purchases and businesses, an attacker could assemble detailed profiles of shopping behavior, according to Hudson Rock researchers.

The presence of coupon codes in the dataset was flagged as an additional avenue for abuse, and researchers said the combination of personal details, purchase history and merchant information could allow scammers to craft highly targeted phishing messages.

Ransomnews researchers who analyzed the leaked material identified a separate concern tied to the API keys themselves. Of 659 keys examined, 650 were found to be live secret keys and nine were restricted keys, with all 659 marked as valid, indicating the party that assembled the dataset had tested the credentials and confirmed they functioned. A Stripe secret key can grant programmatic access to an account beyond simple login credentials, potentially allowing whoever holds it to view customer data, issue charges or refunds, and, depending on permissions, alter payout settings. It remains unclear how many of the keys are still active, a factor that depends on whether affected businesses have since detected the exposure and rotated their credentials.

Researchers said it is not yet clear whether the incident stems directly from a breach of Stripe’s systems. "It’s not clear if this is a Stripe breach directly," the researchers said. "This all could’ve been done with leaked API keys, and that’s it." If the data was gathered using credentials already compromised at the level of individual Stripe customers, the incident would represent a broad credential exposure rather than a compromise of Stripe’s core infrastructure.

Researchers said the dataset may have been assembled using API keys that were publicly exposed. Stripe offers application programming interfaces that let businesses build payment processing directly into their own software, a integration point researchers identified as a possible vulnerability. Because API keys function as sensitive credentials, their exposure can grant attackers access to data or account functions depending on the permissions attached to each key. Businesses can inadvertently expose such credentials through source code, public code repositories or application logs as a result of human error. If that scenario applies here, the incident would likely involve numerous individual companies whose credentials were separately compromised rather than a single breach affecting Stripe directly.