Dodo Payments breach: claimed, confirmed — and not yet published
On 15 August 2026, the DireWolf ransomware group listed DodoPayments — an India-based, PCI DSS Level 1 merchant-of-record fintech used by thousands of indie SaaS founders — on its Tor leak site. The next day, Dodo confirmed a security incident. The attackers publish a data-warehouse briefing (60.8 GB, ~39.3M rows) but the actual files are not yet downloadable. We verified the claim at metadata level and cross-checked it against Dodo's official response and the coverage trail.
Timeline
| Date | Event | Source |
|---|---|---|
| May 2025 | Earliest data in the leak inventory — exfiltrated material spans 15 months, up to August 2026 | DireWolf briefing |
| 15 Aug 2026 | DireWolf publishes the DodoPayments victim page (article 82) with a "Data Warehouse Briefing" | Tor leak site, verified live 28 Aug |
| 16 Aug 2026 | Dodo becomes aware of the incident and contains it "within hours" | Official statement |
| 16–17 Aug 2026 | Threat-intel trackers list the victim: HookPhish, then Breachsense, SOCRadar, DeXpose | Media table below |
| 17 Aug 2026 | Dodo publishes its full statement: Metabase CVE-2026-72898 in an internal analytics system | Official statement |
| 20 Aug 2026 | Our prior recon: keycloak.dodopayments.com admin console exposed (HTTP 302) — after the incident window | Our own probe |
| 22 Aug 2026 | Beralock details the 60.8 GB / 1,342-file listing | Beralock intel |
| 28 Aug 2026 | Leak page re-verified live over Tor; no dump files published yet — all download endpoints 404 | This verification |
What the leak briefing claims
DireWolf's page is not a file dump — it is a generated inventory of what they say they took. The profile is unusually specific, which is what makes it testable:
| Database | Rows | Size | Stated content |
|---|---|---|---|
| prod_psp_recon | 19,885,940 | 31.36 GB | Stripe & Airwallex raw objects, PeerDB CDC streams, customers, invoices, subscriptions, KYC/KYB, fraud events, ledgers |
| prod | 18,085,954 | 27.46 GB | Core billing warehouse: subscriptions, invoices, discounts, entitlements, credit ledgers, KYC, Keycloak identity, PSP records |
| dev | 752,937 | 1.21 GB | Dev mirror incl. test payments, Keycloak mirror |
| dev_psp_recon | 600,270 | 718 MB | Dev PSP reconciliation (test objects, test ledgers) |
Sensitive categories in the inventory: ~249K KYC/KYB verification rows, payout bank accounts, UBO (ultimate beneficial owner) requests, a Keycloak identity store including credential tables and offline sessions, internal auth tables (API keys, signup/login OTPs), fraud-prevention fingerprint events with user emails and client IPs, and invoices with billing addresses and tax IDs.
The inventory lists PeerDB CDC replication streams, dev database mirrors and Keycloak credential tables. That is not the shape of a Metabase reporting export — it is the shape of wholesale ClickHouse warehouse exfiltration, including infrastructure that a BI tool would normally never touch. Either the Metabase service could query vastly more than a "single internal reporting system", or the exfiltration went beyond the analytics instance. This is the central open question.
Claim vs. claim: the open questions
| Lens | DireWolf briefing (attacker-authored) | Dodo statement (17 Aug) | What we can state |
|---|---|---|---|
| Entry point | not stated in briefing | Metabase CVE-2026-72898 (SQL injection → auth bypass, GHSA-vwf4-m7j8-wcjf); "did not require any Dodo Payments credential" | Consistent with a self-hosted Metabase being the initial foothold — the briefing doesn't claim a vector |
| Scope | 4 full databases incl. prod + dev, CDC streams, Keycloak, PSP reconciliation | "limited to this single internal reporting system" — a Metabase analytics instance | Tension A BI layer holding CDC logs, dev mirrors and credential tables would mean extremely broad standing access from the reporting tool |
| Card data | raw Stripe/Airwallex objects listed | no full card numbers held; PCI DSS unaffected; cardholder data resides with PSPs | Plausible: PSP objects (charges, intents, payouts) are processor-side records and need not contain PANs — but full reconciliation data is still commercially sensitive |
| Credentials | Keycloak credential tables + API keys + OTPs listed in inventory | "No password, credential or MFA factor was compromised"; API keys not stored in the affected system | Unresolved — presence in an inventory is a claim, not proof of exfiltration of usable secrets; dump publication is the test |
| Funds | balance/wallet/ledger tables listed | "No funds were accessed" | Ledger tables are records, not money movement — consistent, but settlement metadata is exposed |
| Dump publication | promised, not yet released | n/a | As of 28 Aug: no downloadable files. Authenticity is not yet verifiable — the briefing is attacker-authored |
This is metadata-level analysis of the attacker's own inventory — programmatically extracted from the Tor leak page, human-directed, cross-referenced. No dump contents have been downloaded (none are published), no PII from the leak is republished, and every claim above is attributed to its source. An attacker-authored briefing is an allegation, not evidence; Dodo's statement is one party's account. The row counts are internally coherent (prod ≈ dev mirrors + recon deltas), which lends plausibility but is not proof.
Dodo's response, in brief
- Root cause: CVE-2026-72898 — SQL injection enabling auth bypass in self-hosted Metabase, used for internal reporting only
- Containment: aware 16 Aug, contained within hours — patched, restricted the endpoint, revoked all sessions, OAuth tokens and internal API keys, preserved forensics, documented attacker infrastructure for authorities
- Stated impact: "information relating to some of our merchants" — categories and affected parties still being determined; affected merchants to be contacted directly
- Stated non-impact: payment processing, full card numbers, PCI DSS certification, API keys/credentials, funds, service availability
- Remediation: removing internet exposure from internal analytics, SSO + IP allow-listing + WAF on admin interfaces, formal patch-monitoring for self-hosted tools, log retention expansion, re-architecting reporting-tool data access, independent assessors; SOC 2 and ISO/IEC 27001 said to be in progress
- Contact: privacy@dodopayments.com for incident queries; their security policy notes no monetary bug bounty
Media & tracker coverage
| Outlet / tracker | Date | What they reported |
|---|---|---|
| HookPhish | 16 Aug 2026 | First tracker listing: DireWolf hits DodoPayments, discovered 15 Aug 20:27 UTC |
| Breachsense | 17 Aug 2026 | Breach record; separately notes pre-existing credential exposure for the domain (infostealer logs — not linked to the ransomware incident) |
| SOCRadar | 17 Aug 2026 | Victim entry, confidence 100%, status "Claimed" |
| DeXpose | Aug 2026 | DireWolf statement quoted: "The full leak will be published soon, unless a company representative contacts us" |
| Beralock | 22 Aug 2026 | Details the 60.8 GB / 1,342 files / 4 databases / ~39.3M rows inventory |
| Reddit (r/pwnhub), X, LinkedIn PSAs | 16–17 Aug 2026 | Community + founder PSAs; Dodo's co-founder amplified the containment claim ("No funds moved") |
| Dark Reading (group profile) | 2025–26 | DireWolf background: Golang ransomware, first documented May 2025, ~100+ victims, double extortion, ransoms up to $500K |
What this means for merchants & buyers
- If you sell through Dodo Payments: assume your business profile, billing details and payout metadata were in the exposed warehouse until Dodo's review concludes. The official advice (rotate API keys, watch for phishing) is sound even as hygiene.
- If you bought from a Dodo-powered store: your email and purchase metadata may be in the inventory. Full card numbers are claimed absent — card data lives with Stripe/Airwallex — but treat unexpected payment-themed email as hostile.
- The real lesson: an internal analytics tool became the breach surface. "The dashboard doesn't process payments" is not a security boundary — whatever a reporting tool can query, it can leak.
- Status: this page is a live verification. When (if) DireWolf publishes the actual files, we will run a score-by-evidence download pass over Tor and update the claim-vs-claim table with file-level findings — PII-free, as with the BoB breach verification.