Actor allegedly sells API keys of unidentified French IT company
An actor using the handle libreboot2016 is advertising the sale of Vercel, Stripe, Pennylane, Wedof, Resend, and Supabase API keys of a French IT services and professional training company based in Haguenau, according to DarkWebInformer. The actor claims access to payment details for approximately 1,800 customers and asks $200; the claim is unverified and the company has not been identified. No fix applies; companies should check for and rotate their own exposed API keys.
What happened
According to DarkWebInformer, an underground forum seller is offering keys to Vercel, Stripe, Pennylane, Wedof, Resend, and Supabase accounts of a French IT services and professional training company based in Haguenau. The seller claims to hold payment details for approximately 1,800 customers and thousands of financial documents. The claim is unverified and the company has not been identified.
Why it matters
If confirmed, the access exposes customer data, payment records, invoices, internal databases, and authentication systems. Payment keys in criminal hands enable financial fraud and continued access to systems. The case shows the risk of leaked API keys for any company using these services.
What to do
No fix applies to this third-party incident. Check whether your company's API keys appear in leaks or public repositories and rotate any exposed ones now. Confirm every key has least-privilege permissions and usage monitoring.
For the technical team
- Affected
- Empresa francesa não identificada de serviços de TI e formação profissional, sediada em Haguenau; chaves de API de Verce · Unidentified French IT services and professional training company based in Haguenau, described as having €1.6 million in annual revenue. No specific product or version cited.
- Exploitation
- Sale announced by an actor on an underground forum, reported by DarkWebInformer. Claim unverified; no confirmed exploitation, PoC, or KEV entry cited.
- Fix
- No fix cited in the sources; the incident is an alleged credential sale. General mitigation: rotate exposed API keys and apply least-privilege permissions.
- Vector
- Method of compromise not described in the sources. The sale involves API keys for Vercel, Stripe, Pennylane, Wedof, Resend, and Supabase; cited exposure includes customer information, payment records, invoices, internal databases, and authentication systems.
- More details
- The actor claims access to payment details for approximately 1,800 customers, thousands of financial documents, and CRM records, and asks $200 for the credentials. First report: sale announced on an underground forum, no date cited.
Timeline
First report: actor advertises the credentials for sale on an underground forum.
Sources 1 source
- @DarkWebInformer @DarkWebInformer
