Security researchers have uncovered a worrying situation where over 50,000 Stripe API keys were found publicly accessible. These keys were exposed through GitHub repositories, GitHub Actions logs, and improperly configured web servers. This exposure presents an immediate threat of unauthorized access and financial fraud for businesses using these keys.
The investigation by Ransomnews researchers revealed that a significant number of these keys are still active, allowing cybercriminals to exploit them rapidly. Within hours, malicious actors can use these keys to access merchant databases, create fraudulent payment links, and conduct test transactions. Active keys hold extensive permissions, enabling access to customer data, processing of charges, and even the issuance of refunds.
The leakage mainly stems from hardcoded keys in public and private repositories, accidental logging of sensitive information in build processes, and credentials left on misconfigured servers. While Stripe has automated tools to detect exposed keys in public repositories, their effectiveness is limited due to low participation from users and lack of coverage for private repositories.
Security experts are advising merchants who may be affected to perform comprehensive audits of their API keys. They should rotate any keys that have been exposed and use restricted keys for third-party integrations. Activating Stripe Radar can also enhance fraud detection capabilities. This incident highlights the urgent need for improved credential management and continuous monitoring to prevent unauthorized access.
In addition to this, other security breaches have been identified, such as an unsecured database containing vast amounts of personal data and unauthorized access at a Japanese digital infrastructure provider. These incidents underline the ongoing challenges in protecting sensitive information across various platforms.