Investigating

Rakko: misuse of a Stripe live API key may have exposed payment-related data for 100 customers

Possible data leak: On Aug 24, 2026 unusual log-read API calls with the Stripe live key from non-company IPs were detected and the key revoked. First notice Aug 25; follow-up identified 100 possibly affected customers notified Sep 2. No financial misuse found. Service login passwords out of scope.

Last updated: 2026-11-09

Overview

100 people.

Timeline

UnknownOccurred
2026-08-24Discovered
2026-08-25Disclosed

Organization response

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

What you can do

Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.

Sources

Stripe本番環境APIキーに対するセキュリティインシデントについての調査結果および対応状況のご報告ラッコ株式会社 · 2026-11-09
Stripe本番環境APIキーに対するセキュリティインシデントについてラッコ株式会社 · 2026-11-09

Rakko: misuse of a Stripe live API key may have exposed payment-related data for 100 customers

Overview

Timeline

Organization response

What you can do

Sources

Related information

No published information yet

Comments and replies

Write a comment