SafePal Discloses Authorization Flaw Exposing Order Data of 39,798 Customers: 16 outlets compared

SafePal breach details

The company said the affected orders were placed between Mar 2, 2025, and Apr 11, 2026, and that the exposed records included names, email addresses, shipping addresses, phone numbers and purchase histories.

SafePal said the breach did not involve access to “seed phrases”, private keys, wallet passwords, bank account information, payment card numbers or government-issued identification numbers, and it said it found no evidence of unauthorized wallet access or asset theft.

In response, SafePal said it fixed the issue and introduced further security measures, including reducing personal-data retention in its order-processing system to 90 days.

Phishing risk and warnings

SafePal warned that exposed order details could be used for targeted phishing and impersonation attempts, with attackers armed with genuine names, addresses and purchase details to craft more convincing fraudulent communications.

The company said attackers may impersonate SafePal employees and try to steal wallet credentials by using firmware updates, refunds or replacement devices as a pretext.

SafePal also told customers to treat unexpected contact as suspicious, and it warned: "Consider suspicious any contact unexpected or hardware delivery that references your SafePal purchase".