SafePal Confirms Order-Data Breach Affecting About 39,798 Customers
Summary
SafePal says an authorization flaw in an order-tracking plug-in exposed order and contact details for about 39,798 customers. The company says wallet credentials and funds were not affected, fixed the flaw, and warned of phishing risks.
Key points
- SafePal confirmed that about 39,798 customers were affected; the company says the exposed records covered orders placed from March 2, 2025, to April 11, 2026.
- An authorization flaw in an order-tracking plug-in allowed access to other customers’ order records.
- Exposed information included names, email addresses, shipping addresses, phone numbers, and purchase details.
- SafePal says seed phrases, private keys, wallet passwords, bank details, card numbers, government IDs, and funds were not exposed.
- SafePal says it fixed the flaw, added controls, notified affected customers, and engaged an independent firm to review its order systems.
- SafePal reported that individuals claim to be selling the data, but said it could not verify those claims; it warned of targeted phishing and impersonation.
Article Details
- Victim Organization
- SafePal
- Victim Domain
- safepal.com
- Incident Type
- Data exposure caused by an authorization flaw in an order-tracking plug-in, which allowed access to other customers' order records.
- Data Types Exposed
- Names
- Email addresses
- Shipping addresses
- Phone numbers
- Purchase details
- Affected Records
- About 39,798 customers, according to SafePal.
- Operational Impact
- SafePal fixed the flaw, added security controls, notified affected customers, engaged an independent third party to validate the fix and review its order systems, and reduced order-data retention to 90 days. Seed phrases, private keys, wallet passwords, bank details, card numbers, government IDs, and funds were not exposed, according to SafePal.
- Ransom Or Extortion
- No ransom demand is reported. Unnamed individuals claim to own and offer the dataset for sale; SafePal says it cannot verify those claims.
- Claim Status
- confirmed