Fintech giant Stripe faces alleged data breach as customer information leaks

A dataset loaded with sensitive data allegedly linked to Stripe customers has surfaced on a cybercrime forum.

Stripe, the American fintech giant that processes payments for millions of businesses, has appeared in a listing on a cybercrime forum.

A threat actor claims to be offering access to a dataset containing around 35GB of data. The alleged dataset appears to contain logs that expose information about companies using Stripe for payment management. The data includes:

• General statistics about shops: how many customers a particular domain has, the amount of money that was handled and logged, and the transaction count
• Account information of companies using Stripe, including an email, Stripe API key, and account flags
• Product logs
• Customer logs, including full names, contact information, and, in some cases, addresses.
• Coupon codes

Cybernews researchers have examined the claims. According to them, the threat actor has been active for a long time, and the information examined so far appears legitimate. The size of the dataset also appears broadly consistent with the roughly 35GB claimed by the actor.

According to cybersecurity firm Hudson Rock, the dataset contained 669 specific vendors and 1,033 compromised API keys.

Hudson Rock researchers state they spoke to the threat actors minutes after the data was released. During this exchange, they claimed that the released data represents only a small part of the package.

According to the actor, they possess approximately 20,000 compromised Stripe APIs, which they intend to release in subsequent batches.

Stripe clients exposed to the risk of fraud

According to the analysis, the dataset contains records from multiple companies that use Stripe, rather than appearing to consist solely of information belonging to Stripe itself.

Among the data are logs containing general statistics about individual online stores, including customer numbers, transaction counts, and amounts of money processed.The dataset also contains account information associated with businesses using Stripe.

Another type of exposed data is customer records. They include full names and contact information, and in some cases, addresses. Those customers can also be referenced by user IDs that appear in transaction logs.

That linkage could make the dataset considerably more valuable to criminals than a simple collection of names and email addresses.

By connecting customers to products, transactions, businesses, and purchasing patterns, an attacker could potentially build a detailed picture of what particular people buy and where they shop.

The dataset reportedly also contains coupon codes, creating another potential path of exploitation. All this information could be used by scammers to create phishing campaigns.

An attacker who knows a person's name, contact details, the company they bought from, and the type of product they purchased can tailor a highly convincing phishing message.

“The data shows detailed trends of how people shop,” the researchers said.

“It's super easy for malicious actors to cross-reference all this info to profile these people and craft convincing scam campaigns.”

Ransomnews researchers, who analyzed the dump, identified an additional risk associated with the exposed data. According to them, of the 659 keys found, 650 are live secret keys, and nine are restricted keys. All 659 are marked as valid, suggesting the collector tested each key and found that it worked.

That is significant because a Stripe secret key is not simply a password for logging into a dashboard. It can provide programmatic access to a Stripe account, potentially allowing whoever controls it to access customer data, create charges, issue refunds, and, depending on the key's permissions, alter payout settings.

It is unclear how many of the keys still work today. That depends on whether the affected companies have since detected the exposure and rotated their credentials.

There may also be more direct financial risks.

Exposed coupon codes could potentially be abused, depending on how individual merchants configured their promotions.

Compromised API credentials could pose a more serious problem if they grant attackers permissions to access or manipulate sensitive account data.

Breach or credential exposure?

“It's not clear if this is a Stripe breach directly,” the researchers said.

“This all could've been done with leaked API keys, and that's it.”

If compromised credentials belonging to individual Stripe customers were used to collect the data, the incident could represent a large-scale credential exposure rather than a compromise of Stripe's core infrastructure.

According to the researchers, the alleged dataset could have been collected via publicly exposed API keys.

Stripe provides APIs that allow businesses to integrate payment processing into their own applications. That could be a weak point.

API keys are sensitive credentials, and exposing them can give attackers access to data or functionality depending on the permissions associated with the key.

Companies can accidentally expose credentials in source code, public repositories, or application logs due to human error.

If that is the case here, the incident could involve multiple individual companies whose credentials were compromised rather than a single data breach of Stripe's infrastructure.

Cybernews has reached out to Stripe for a comment. We will update this article once a response is received.