SafePal Reports Data Breach Affecting 39,798 Customers' Order Information
SafePal, a cryptocurrency wallet maker, has disclosed a data breach that has affected the order information of 39,798 customers. This breach includes sensitive data such as names, email addresses, shipping addresses, phone numbers, and purchase details. The company identified the cause of the exposure as an authorization flaw in a plug-in used for order tracking, which under certain conditions allowed one customer to view another's order information.
The affected orders were placed between March 2, 2025, and April 11, 2026. SafePal first received reports of the issue in early May, initially treating it as an isolated incident. However, as the investigation progressed, it escalated into a formal security inquiry, leading to the implementation of additional protective measures.
In May, a customer reported receiving a suspicious email and phone call from someone claiming to represent SafePal, warning of a security issue with a recently purchased hardware wallet. The customer was directed to click a link to resolve the issue but later confirmed with SafePal that the communication was not legitimate. While there is no confirmed link between this phishing attempt and the data breach, the timing and details available to the impersonator raise concerns.
SafePal has assured customers that critical information such as seed phrases, private keys, wallet passwords, bank account details, payment card numbers, and government-issued IDs were not compromised in the breach. The company emphasized that there is no evidence suggesting that the breach allowed unauthorized access to SafePal wallets or funds. However, they cautioned that the exposed order information could be exploited for targeted phishing and impersonation attempts, urging customers to remain vigilant.
On August 16, SafePal notified affected customers via email, informing them of the breach and the potential risks associated with their exposed order information. The company has since rectified the authorization flaw, engaged an external security firm to assess the situation, and reduced the retention period for personal order data to 90 days. Additionally, SafePal has taken action against over 30 phishing sites and fraudulent links related to the incident and continues to monitor for new threats.
Reports indicate that a threat actor is attempting to sell the compromised data on a cybercrime forum, claiming it matches the details disclosed by SafePal. The listing includes offers to share order IDs and shipping countries for verification purposes. As of now, there is no confirmation regarding the authenticity of the data being sold.
SafePal has advised customers to be cautious of any unexpected communications or deliveries related to their purchases, regardless of the medium. They reiterated that customers should not feel compelled to move their assets solely due to the breach, but if they have shared sensitive information in response to suspicious messages, they should consider their wallets compromised.
