OpenRouter · Breach

Claim: OpenRouter database and API keys offered for sale

Oct 25, 2026 · 1 min read

A threat actor on an underground forum claims to sell records of about 250,000 openrouter.ai users and 207,847 API keys, including emails, names and password material (hashed, some plaintext claimed). The claim is unverified. Users should rotate API keys and passwords.

By HIFY Radar newsroom Updated 10/26/2026 02:33 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on an underground forum claims to sell data on about 250,000 OpenRouter users and 207,847 API keys. The alleged dataset includes emails, names and password material. Nothing is confirmed; the claim has no independent verification.

Why it matters

If the keys are real, third parties could run unauthorized AI model spend on the company's behalf and take over accounts. Exposed emails and passwords fuel phishing and credential stuffing on other services. The risk affects any team using OpenRouter to access AI models.

What to do

Rotate all OpenRouter API keys and account passwords now. Review key usage for unauthorized spend. Review access on service accounts.

For the technical team

Affected: OpenRouter (openrouter.ai), plataforma de roteamento de APIs de IA · OpenRouter (openrouter.ai): alleged records of 251,996 user rows and 207,847 API keys, per the actor.
Exploitation: No confirmed exploitation in the sources. Sale alleged in an underground forum post on 2026-10-26, reported by DailyDarkWeb; claim not independently verified.
Fix: No product fix cited. Mitigation for users: revoke and rotate API keys and passwords.
More details: Keys alleged in sk-or-v1 format, a mix of active, revoked and expired. Alleged user fields: emails, usernames, password material (hashed and some plaintext claimed), names, signup dates, credits, plan and country. Alleged API-key fields: user linkage, key values, creation and last-used timestamps, spend and rate limits. DailyDarkWeb redacted key values and sample rows and classifies the case as an unverified threat-actor claim, not confirmation of an OpenRouter compromise.