The past seven days produced three distinct incidents that, together, sketch the actual shape of business risk heading into fall 2026: payment-processing credentials stolen from merchants rather than platforms, enterprise cloud directories pulled wholesale using stolen logins, and a CRM breach that shows how quickly a vendor's cloud environment becomes your company's exposure. None of these started with a sophisticated exploit. Each started with a credential someone forgot to rotate, protect, or monitor.

Stripe Merchant Credential Leak Exposes 688,000 Records

On August 18, a threat actor known as "Satanic" published a dataset on a criminal forum containing data pulled from hundreds of Stripe merchant accounts. A forum user posting as Satanic published what they describe as 662 datasets totalling 33GB, exported from Stripe merchant accounts using 1,033 compromised API keys. Investigators were clear that this was not a platform-level breach: the available evidence does not indicate that Stripe itself was breached, and the exposed credentials belonged to individual merchants. Of the 659 credentials listed, 650 were reportedly live secret keys beginning with the sk_live prefix, while nine were restricted keys, and the collector's index marked every key as valid at the time of collection. The exposure reached an estimated 688,363 customer records across merchants in 42 countries, with significant volumes tied to Canadian cardholders alongside the US. Analysts believe the keys leaked through routine developer mistakes: the described method is theft of merchant credentials, most often from exposed configuration, repositories or infected developer machines, followed by ordinary use of the payment interface. One researcher demonstrated just how fast a single live key becomes damage: a single active key could be used to access a merchant's customer list, create a fraudulent payment link, and make a test charge within 17 hours. Any business processing payments through Stripe, or through a platform built on it, should treat this as a direct warning, not background noise.

Azure Credential Theft Campaign Hits McDonald's, Vodafone, and Enterprise Vendors

A separate seller, "TheHatman," spent the past week flooding criminal forums with employee directories allegedly pulled straight from corporate Microsoft cloud tenants. The seller claims to have pulled these records directly from victim organizations' Azure and Entra tenants using compromised credentials, and over the past week, TheHatman has flooded underground forums with listings for at least nine Fortune 500-level enterprises spanning IT services, hospitality, telecommunications, retail, and logistics. McDonald's Corporation tops the list with more than 1.7 million exposed records, followed by Tata Consultancy Services at roughly 800,000, Vodafone at approximately 425,000, and HCL Technologies at around 250,000, with additional victims including InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. The most concerning detail isn't the volume, it's what was included: the datasets contain access and group mapping information, including service account details and, in some cases, listings of Global Administrator accounts, which hands attackers a ready-made blueprint for spear-phishing, social engineering, and targeted privilege escalation. Researchers point to a familiar root cause: the attack vector is not conclusively determined, but evidence strongly suggests the use of infostealer malware to harvest credentials, with possible contributions from phishing and insufficient multi-factor authentication enforcement. Every one of these organizations touches North American vendors, contractors, and franchisees, meaning the downstream phishing risk extends well past the named companies.

Vendor and CRM Breaches Keep Compounding SMB Exposure

Global supply chain distributor Wesco confirmed it is investigating a breach after a data extortion group called ExfilSquad claimed to have stolen customer and employee data. Wesco confirmed in a statement that it is investigating a cybersecurity incident, after data extortion group ExfilSquad claimed to have stolen sensitive information from Wesco and leaked it on their data leak site. ExfilSquad claimed to have stolen 2.6 million records containing personal information, account data, and CRM user profiles, and subsequently published the data after Wesco did not meet their ransom demands. Separately, hardware wallet maker Trezor disclosed that its shipping partner ShipMonk was compromised, exposing customer names, addresses, and contact details. The same week a Windows privilege-escalation flaw went public, hardware crypto wallet maker Trezor disclosed that a breach at its shipping and fulfillment partner, ShipMonk, exposed data for roughly 13,689 buyers, with 11,742 of those customers having full exposure: name, email, phone number, and shipping address. Neither company's core systems were touched. In both cases, the damage flowed through a third party. Industry-wide data backs up the pattern: the Verizon 2026 Data Breach Investigations Report found that third-party involvement rose to about 48% of breaches this year, with the human element featuring heavily across sectors.

What Individuals Should Do This Week

  • If you've used a card with a merchant that runs on Stripe recently, monitor statements for small test charges, a classic sign of a validated stolen key.
  • Check whether your email address appears in a breach database using a reputable lookup tool, and rotate any reused passwords immediately.
  • Treat unexpected emails referencing your employer, job title, or manager by name with extra suspicion, this level of detail is now sitting in criminal-targeting sources tied to the Azure campaign.

What Businesses Should Do This Week

  • Rotate every live API key tied to payment processors, and move to restricted, scoped keys rather than broad account-level secrets.
  • Audit Entra ID and Azure sign-in logs for unusual Microsoft Graph API activity, and enforce phishing-resistant MFA plus conditional access on all administrator accounts.
  • Review every vendor with access to your CRM, shipping data, or customer records; a breach at a logistics or SaaS partner is now as damaging as a breach of your own network.
  • Remember that business registry data, corporate addresses, director names, and incorporation details, sits in public business registries fraud operators scrape to build targeting lists, so verify any unusual funding or vendor-change request through a second channel before acting.