Overview
- SafePal disclosed Sunday that 39,798 customer orders placed between March 2, 2025, and April 11, 2026, had their names, emails, shipping addresses, phone numbers, and purchase details exposed.
- The company traced the leak to an authorization flaw in an order-tracking plug-in and a separate configuration error that stopped a scheduled data-cleanup from September 2025 through April 2026, which extended the retention window back to March 2025.
- SafePal said seed phrases, private keys, wallet passwords, payment card numbers, bank account data, and government IDs were not exposed and that it has found no evidence the incident directly compromised wallets or funds.
- In response, SafePal patched the plug-in, notified affected users by email, engaged an independent security firm to audit fixes, removed more than 30 phishing domains, launched a verification tool, and shortened order-data retention to 90 days.
- The exposed order metadata makes targeted phishing and impersonation attacks more likely, a risk seen in prior wallet-industry incidents and one that underscores how third-party systems and retained customer data can erode security even when hardware wallets remain intact.