Threat Actor "Satanic" Leaks 33GB of Stripe Merchant Data on Cybercrime Forum On 18 August 2026, the threat actor known as "Satanic" uploaded over 33GB of allegedly stolen Stripe-related files to the cybercrime forum PwnForums. The actor, previously linked to breaches involving ClickFunnels, WooCommerce, and Magento, claimed possession of 20,000 compromised Stripe API keys, though only 1,033 exposed keys many with the sk_live_ prefix for live payment environments were verified in the leaked dataset. Analysis by Hackread.com revealed 669 merchant account folders and 323 unique business domains after filtering duplicates and generic email providers. The breach did not stem from a compromise of Stripe’s systems but rather from exposed merchant credentials. Potential sources include hardcoded API keys in public GitHub repositories, unsecured configuration files, infostealer malware, or automated scans for exposed .env files. The leaked data contained 688,363 customer records, including: - Personal details (names, emails, phone numbers, addresses) - Partial payment card data (last four digits, brand, expiry dates) - Transaction histories (billing amounts, invoices, IP addresses) - Active discount codes and internal identifiers For 519 merchant accounts with both payment and payout capabilities, the exposure could enable fraudulent charges, unauthorized refunds, or payout redirection if the keys remain active. While the dataset does not confirm whether all keys are still valid, the financial and privacy risks for affected merchants and customers are significant. Stripe has not commented on the incident, but the breach underscores the dangers of unsecured API keys and poor credential hygiene in payment processing environments.