Stripe Faces Unverified $1 Million Extortion Threat Over Alleged Vulnerability

A threatening message reportedly appeared on Telegram on October 21. The channel says hackers can drain accounts because of an unnamed vulnerability. The target is Stripe, one of the biggest payment companies in the world.

The senders want $1 million in Bitcoin or Monero within 72 hours. However, the message shows no evidence. For now, it is a threat and nothing more.

What the Ransom Note Says

The message is addressed to the Stripe security group and mentions three entities: ShinyHunters, LAPSUS$ and UNC6783. The attackers assure that the vulnerability allows them to steal money from millions of accounts and claim that “internal testing” verified the issue.

They claim that they will provide more information on the vulnerability, along with proof, once they receive the payment. Also, they guarantee that they won’t exploit the vulnerability again. The hacker threatens to leak the account info and publish proof if Stripe refuses to engage with them.

The same channel advertises a new upcoming forum called CrimeForums. A screenshot of the post shows it has so far received only 19 views.

Brief History of ShinyHunters

ShinyHunters first appeared in 2020. It steals data and uses a pay-or-leak model rather than locking files. The FBI says the group and its partners have breached more than 140 organizations since last year. The bureau also says they collected at least $70 million in extortion payments.

Still, ShinyHunters is not one tidy gang. Researchers say its members overlap heavily with Scattered Spider and LAPSUS$. Pressure on the group is rising, too. Dutch police recently arrested a man the FBI called one of its alleged leaders.

LAPSUS$ became known for breaking into tech companies. In July, however, it announced an alleged permanent shutdown. That raises questions about who is using the name now.

UNC6783 is a label from Google’s threat team. Google says this money-driven cluster compromises outside support companies and targets help desk staff. Workers get sent to spoofed login pages. Google reportedly links the cluster to a hacker called Raccoon. That persona claimed an Adobe data theft from a support firm in India.

Why the Group’s Claim is Doubtful

First, nobody has shown a flaw. The identities behind the channel and the claimed Stripe vulnerability remain unverified. In contrast, Burger King Japan confirmed an app data breach involving 11.18 million records, showing the importance of distinguishing verified security incidents from unsubstantiated claims.

Second, the method looks different. Reports on these groups describe phishing calls, fake login pages, and weak help desks. Afterward, the groups threaten to leak what they stole. Draining money through a hole in a payment system would be a big change in approach.

Third, it’s easy to fake names. A good instance is when an entity posing as ShinyHunters claimed a breach at Vercel, but the real group leaders later denied involvement.

Fourth, exaggeration is part of the pattern. An FBI advisory says these actors may overstate their access to sensitive information. In September, the group even told reporters its FBI hack was about disputing that advisory, not about money.

The 72-hour deadline does fit their usual style. Earlier campaigns also demanded Bitcoin within 72 hours. Even so, a copycat can borrow a style just as easily.

A Possible Link to Another Claim

Separately, a group calling itself ShinyEquationCartel posted three sale ads on October 17. It claims to hold flaws in Windows and Apple remote-access tools, plus data from Backbase and Global-e. That group says it has ties to ShinyHunters, but this is unverified too.

Notably, the Stripe note lists a contact handle with a similar name. That hints at a connection between the two. Nothing proves it, though.

What’s Next?

If the clock started on October 21, the deadline lands around October 24. I found no public statement from Stripe. Its choice is unknown.

Other targets have refused. As Bloomberg reported, Salesforce told customers last October it would not engage, negotiate with or pay any extortion demand. Stripe could take a similar path, but that is only a guess.

Meanwhile, watch for real evidence. A technical write-up from researchers would matter. So would a statement from Stripe, or proof of stolen money. Until one of those appears, the claim stays a claim.

Safety Tips for Stripe Users 

Stripe users have no confirmed reason to panic. Even so, basic steps help. Turn on the strongest login protection available, ideally physical security keys. Google’s Mandiant recommends these keys against UNC6783-style attacks, along with regularly checking MFA device enrollments.

Next, review recent payouts and see who has access to your account. Finally, be careful with emails that mention this threat. Scammers often use big news as bait.

This is an unproven extortion threat, not a confirmed breach. The message is bold, but bold words cost nothing. The groups named in the claim have a history, but their modus operandi differs from what the latest claim shows.

Normally, they steal information, not drain accounts. Without proof, the most sensible approach is to take the threat seriously, but not treat it as a confirmed breach.