SafePal Says Order-Tracking Flaw Exposed Data of 39,798 Customers
Summary
SafePal says an exploited order-tracking flaw exposed personal and order data for about 39,798 customers. A threat actor claims to be selling the data, which BleepingComputer has not independently verified; SafePal says wallet credentials and funds were not compromised.
Key points
- SafePal says the flaw exposed names, email and shipping addresses, phone numbers, and purchase details for about 39,798 customers who ordered between March 2, 2025, and April 11, 2026.
- SafePal says seed phrases, private keys, passwords, payment information, and other credentials were not exposed, and it found no evidence that wallets or funds were compromised.
- The company identified an authorization flaw in an order-tracking plug-in that allowed access to another customer’s order information; it says a threat actor exploited it to steal the data.
- A threat actor claims to be selling the data on a cybercrime forum. BleepingComputer says it has not independently verified the seller possesses it.
- SafePal says it fixed the flaw, notified affected customers, purged personal data from active e-commerce servers, and is working with a security firm to validate the fix and review its systems.
- SafePal warns that exposed information could enable targeted phishing and phone scams, and says it has taken down more than 30 fraudulent websites and phishing links tied to the incident.
Article Details
- Victim Organization
- SafePal
- Incident Type
- Data breach caused by exploitation of an authorization flaw in a plug-in's order-tracking function, allowing unauthorized access to customer order information.
- Data Types Exposed
- Names
- Email addresses
- Shipping addresses
- Phone numbers
- Purchase information
- Affected Records
- Approximately 39,798 customers
- Operational Impact
- SafePal fixed the vulnerability, added security measures, purged affected personal data from active e-commerce servers, and retained an encrypted offline copy for potential law-enforcement investigations. SafePal reported no evidence that the incident compromised wallet access or funds.
- Ransom Or Extortion
- An unnamed threat actor claims to be selling the stolen data on a cybercrime forum. BleepingComputer said it had not independently verified possession of the data.
- Claim Status
- confirmed