OpenRouter user database and API keys allegedly compromised and offered for sale affecting approximately 250,000 users.
AI & Agents ·
A threat actor on an underground forum has claimed to be offering a database tied to OpenRouter for sale, allegedly containing user records and API credentials. The actor states the dataset includes approximately 251,996 user rows and 207,847 API keys in sk-or-v1 format, though the claim remains unverified.
According to the threat intelligence report, the purported user data encompasses emails, usernames, hashed passwords with some claimed to be in plaintext, full names, account creation dates, credit balances, subscription tier information, and geographic location. The alleged API keys carry associated metadata including user linkage, key values, timestamps of creation and last use, spending records, and rate-limit settings. The actor claims the keys exist in various states—active, revoked, and expired.
If the compromise proves authentic, exposed API credentials could permit unauthorized spending on language-model services and compromise user account access, while leaked email addresses and password material would create vectors for phishing and credential-stuffing attacks. OpenRouter has not publicly confirmed a breach, and no independent verification of the sale or dataset integrity has been reported.