Hackers gained access to the payment accounts of two charity projects run by Russian independent media outlets in the Stripe payment system, compromising donor email addresses and, in some cases, partial bank card details. The affected projects are "Davayte," a fundraiser for Ukrainian civilians, and "Ty ne odin," a marathon supporting political prisoners. Both projects sent emails to donors and published statements on their websites.
The attack occurred on August 11. The intruders entered the accounts through Stripe's integration with the WooCommerce service, which the projects used for online auctions. The attack on "Davayte" lasted 61 seconds.
In addition to email addresses, in some cases the last four digits of bank cards, card expiration dates, and the countries of the issuing banks were exposed. Full card numbers, cardholder names, and information about the donations themselves were not compromised. Stripe blocked access and prevented the attackers from downloading the full address database; no fraudulent transactions were detected on the accounts.
After the leak, "Davayte" disabled integrations with third-party services, reissued access keys, and notified the European data protection regulator.
Who is behind the attack is not yet known. Both teams cite two possible explanations: ordinary cybercriminals or Russian security services. "Davayte" has requested data from Stripe to determine whether other clients of the payment system faced similar activity.
"Davayte" is a fundraiser for Ukrainian civilians affected by the war, launched in February 2024 by Sluzhba Podderzhki, Meduza, and TV Rain. The same media outlets, together with Mediazona and structures of the Anti-Corruption Foundation (FBK), hold the annual "Ty ne odin" marathon. In Russia, Meduza, TV Rain, and the legal entity of Sluzhba Podderzhki are designated as undesirable organizations, and FBK is designated as an extremist and terrorist organization.
The marathon, which previously did not accept payments from Russian cards, now advises donors not to make donations even with foreign cards if they live in or visit Russia, or if they report to the Russian tax authorities on movements of funds in foreign accounts. "Davayte" recommends that donors plan trips to Russia with caution.