A seller claims to have OpenRouter's user database and API keys; OpenRouter finds no evidence

The threat-intelligence account DailyDarkWeb reported on October 25 that a seller on an underground forum claims to be offering a database tied to openrouter.ai. The account says the seller claims:

• about 252,000 user rows (roughly 250,000 unique users), with emails, usernames, names, signup dates, credits, plan and country, and password material (hashed, and some plaintext, according to the seller);
• about 207,800 API keys in the sk-or-v1 format (a mix of active, revoked and expired), with user linkage, creation and last-used times, spend and rate limits.

DailyDarkWeb says the claim is unverified and not confirmation of a compromise.

OpenRouter replied on X that it has investigated and has not found evidence of unauthorized access to its data, or validation of any of the claims in the post. It says it will keep investigating and watching for abuse, and will act and notify customers if a leak is verified or abuse is detected.