Fast Facts
- Nearly 40,000 customers’ personal and order data were exposed due to a flaw in an order-tracking plugin, risking phishing, identity theft, and targeted scams.
- A threat actor advertised the compromised dataset online, offering order IDs and shipping info for verification, increasing the risk of fraudulent activities.
- The incident highlights vulnerabilities in third-party logistics and order-processing systems, with potential for further data breaches and customer exploitation.
Threats, Attack Techniques, and Targets
An authorization flaw in an order-tracking plugin exposed personal data of nearly 40,000 SafePal customers. The flaw allowed unauthorized access under certain conditions. It affected orders placed from March 2, 2025, to April 11, 2026. The exposed data included names, email addresses, shipping addresses, phone numbers, and purchase details. The incident did not involve wallet credentials or financial information.
The attacker potentially targeted customers by exploiting the flaw to access their order information. SafePal reported that no evidence showed the incident compromised wallet access or funds. The vulnerability’s cause was linked to a configuration error in a data-cleanup process that left older records accessible for longer than intended.
Criminals are aware that crypto holders are high-value targets because of their holdings in crypto assets. They have been involved in violent incidents and large thefts, as reported by Chainalysis. This situation increases the threat landscape for crypto hardware wallet users and related customers.
Impact, Security Implications, and Remediation Guidance
The breach exposes customers to risks like fraudulent calls, emails, and phishing attempts. Affected individuals may also see fake offers or malicious firmware updates. However, SafePal stated that the incident did not include wallet secrets like seed phrases or private keys. They warned customers to treat any suspicious contact referencing their SafePal purchase as suspicious.
SafePal took immediate steps to mitigate the issue. They fixed the flaw, reduced data retention to 90 days, and purged affected records from active systems. They also engaged a third-party security firm for validation and reviewed their order-processing systems. Fraudulent websites and phishing links linked to the incident have been taken down.
For affected users, SafePal recommended that they do not move assets solely because of this exposure. Those who entered seed phrases or private keys in response to suspicious messages should assume their wallets are compromised.
Remediation guidance should be obtained directly from SafePal or relevant security authorities to ensure proper protective measures are followed.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
