SafePal data breach exposes details of nearly 40,000 users

SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. Summary Nearly forty thousand SafePal customers had order information exposed through an authorization flaw in software. Exposed records included names, emails, shipping addresses, phone numbers and detailed SafePal purchase information externally. Seed phrases, private keys, wallet passwords, payment details and government identification numbers were not exposed. SafePal removed over 30 phishing websites and shortened personal data retention to 90 days afterward. SafePal received a phishing report in May before confirming the authorization flaw during July investigations. The affected records covered orders placed between March 2, 2025, and April 11, 2026, and included names, email addresses, shipping addresses, phone numbers and purchase details. SafePal said it emailed affected customers individually on Sunday and launched a tool allowing buyers to check orders using their order number and shipping country. The wallet provider said seed phrases, private keys, wallet passwords, payment card numbers, bank account informati...