News · Financial Services

Dodo Payments discloses breach of internal analytics system

By Startup Enthusiast · 1 September 2026

What they do

Dodo Payments provides billing, usage metering, and global payment infrastructure for AI and SaaS companies

The company confirmed a security breach involving a third-party internal reporting tool, Metabase, on August 17, 2026

Management stated that sensitive payment data, including card numbers and API keys, remained secure and unaffected

Dodo Payments publicly disclosed a security breach affecting an internal analytics system on August 17, 2026.
A dark web listing claims that 60.8 GB of data was stolen across four databases containing 39.3 million rows.
The stolen dataset allegedly includes KYC verification requests, identity documents, and payout bank account details.
The company clarified that the breach was limited to a self-hosted deployment of Metabase, an internal reporting tool.
Co-founder Rishabh Goel stated that no passwords, API keys, or card numbers were accessed during the incident.
The company maintains that its core payment processing systems remain separate and secure from the affected analytics tool.

The dark web listing claims the stolen data includes 58 different types of records, including internal API and authentication logs.
MediaNama noted that threat actors often inflate the scope and sensitivity of stolen data to increase financial leverage.
The company has not publicly addressed specific claims regarding the exposure of Keycloak identity management credentials.

Dodo Payments operates as a Merchant of Record to facilitate global payments across 190+ countries.
The platform supports credit-based billing, usage metering, and tax compliance for AI and SaaS businesses.
It offers an agentic stack called Sentra that integrates billing directly into the VS Code development environment.
The company provides developer resources including SDKs for React, Next.js, and various other web frameworks.
Dodo Payments is certified as PCI DSS Level 1, the highest standard for payment card security.
The platform claims to serve over 50,000 builders and founders worldwide.

Product: Cross-border payment infrastructure for digital-first merchants
Customers: Merchants and digital-first businesses that accept international payments
How it makes money: It likely earns platform and transaction fees from merchants using its payments stack.
What sets it apart: Supports payments from 150+ countries and local rails in 30+ countries.
Operations: Adds subscriptions, billing, fraud detection and risk modules on top of payments.