Davayte's fix names the component. It disabled third-party integrations, rotated its access keys and notified the relevant European data protection authority [6]. The keys got rotated because what had worked for the intruder was a credential issued to software, not to a person.
That is the layer a small nonprofit does not staff. The WordPress site has an owner, usually whoever built it. The payment account has an owner, usually whoever does the books. The plugin between them holds a long-lived key, updates on the site's schedule if the site has one, and belongs to neither role. Both sides trust it, and neither one checks on it.
The evidence fits that reading. A read key against a processor's stored customer records returns metadata and cannot return a full card number or a cardholder name, which both projects say stayed put [4]. The shutoff also came from the processor's side, part way through an export [5], which is where account-level anomaly detection lives rather than anywhere on the WordPress host.
Keep the two Stripe stories apart. Early in August a hacker using the alias "Satanic" posted an archive said to hold data from 669 merchants and more than 1,000 access keys [11]. That averages roughly 1.5 keys per merchant [12], the profile of estates where each integration gets its own credential instead of one login per company. Whether Stripe itself was breached there is unclear [13], and The Bell reports the archive's records stop on June 1, which places a mid-August theft outside that dataset [14]. Broader targeting of Stripe merchants has been reported, with no confirmed link to these two projects [22]. Davayte has asked Stripe whether other customers saw similar activity [15]. Stripe did not respond to The Record's request for comment [16].
The gap between how valuable this data is and how little attention the connector holding it gets comes down to scale. Davayte launched in February 2024 with backing from independent outlets including Meduza and TV Rain, and says it raised more than $437,000 in 2024 [17]. You Are Not Alone reports around $1.4 million over its first three years [18], an average near $467,000 a year [19], and assistance to roughly 800 political prisoners and their relatives [20]. Those are mid-sized nonprofit donor lists sitting behind budgets that fund food, medicine and legal fees.
The controls that would have capped this are cheap. A key scoped to what an auction actually needs, plus a rotation date that does not wait for an incident, costs attention rather than money. What this case actually charges for is a decision about ownership, made before the next auction instead of during the next intrusion.
