SafePal patches order-tracking flaw after data breach affects nearly 40K customers
Customer data is already listed on the dark web.
Safepal data breach. By Cybernews
- SafePal says a plug-in flaw exposed order data for 39,798 customers after unauthorized access.
- Stolen data includes names, emails, shipping addresses, phone numbers, and purchase details, now listed on the dark web.
- SafePal says wallets, funds, seed phrases, private keys, passwords, and payment details were not compromised.
- The company fixed the flaw, hired an outside security firm, and warns customers to watch for phishing scams.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Crypto hardware wallet SafePal is notifying 39,798 customers that their personal information has been stolen in a recent data breach.
Recently, the SafePal team identified an authorization flaw in the order-tracking function of a plug-in that handles customer order information.
Due to this vulnerability, an attacker gained unauthorized access to customers’ order information.
Anyone who placed an order between March 2nd, 2025, and April 11th, 2026, has been affected. According to the company, this comes down to approximately 40,000 customers. They were all notified of the incident on August 16th.
The attacker managed to exfiltrate customers’ personal information, including names, email addresses, shipping addresses, phone numbers, and purchase details.
“This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers,” SafePal states in a press release.
Although no highly sensitive information was taken, affected customers might be targeted by sophisticated phishing attempts, such as fraudulent phone calls, emails, text messages, letters, refund offers, firmware update requests, fake customer support communications, malicious websites, or other attempts to obtain wallet credentials or additional personal information.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
“This incident occurred solely for the order-tracking plug-in, which is independent of any other SafePal systems. No evidence has been found that the incident itself compromised access to SafePal wallets or funds,” SafePal says on a dedicated page about the incident.
SafePal customer data is already being offered on a cybercrime forum on the dark web.
As of writing, the issue has been fixed, and additional security measures have been implemented. An external security firm has been tasked with validating the fix and conducting a broader investigation into SafePal’s order-processing systems.
The company has also identified and taken down over 30 fraudulent websites and phishing links tied to scam activities, and promises to actively monitor for new ones.
Affected customers are advised never to share seed phrases, private keys, or passwords with anyone. They should also stay vigilant for any suspicious outreach or impersonations. If they receive calls or messages that appear to be fraudulent, they should report this immediately.
