SafePal, a prominent provider of cryptocurrency hardware and software wallet solutions, has disclosed a security incident involving an authorization flaw in an order-tracking plugin. The vulnerability, which existed within a plugin associated with customer order information, allowed unauthorized external access to order records under certain conditions, affecting approximately 39,798 individuals who placed orders between March 2, 2025 and April 11, 2026.
According to the company’s disclosure, the compromised data includes names, email addresses, shipping addresses, phone numbers, and purchase details. SafePal emphasized that more sensitive categories of information were not involved in the breach, specifically noting that seed phrases, private keys, wallet passwords, payment card numbers, bank account details, and government-issued identification numbers remained secure.
The company further stated that no evidence indicates the incident compromised access to SafePal wallets or customer funds. All affected individuals were notified individually via email on August 16 from the address security@safepal.com with the subject line indicating order information had been affected, and the company has published a dedicated verification page where customers can confirm their status using an order identification number and shipping country.
Following the discovery, SafePal remediated the authorization flaw and introduced supplementary security measures. An independent third-party security firm has been engaged to validate the fix and perform a comprehensive review of the broader order-processing infrastructure. The company has also contacted relevant logistics and fulfillment partners to confirm the issue had not spread further within their systems.
Additionally, the retention period for personal information within the affected environment has been tightened to 90 days, subject to applicable legal requirements, and a dedicated support channel has been established to ensure affected customers receive direct, tracked assistance. Progress on these ongoing measures will be disclosed through official company channels.
SafePal has also identified and removed more than 30 fraudulent websites and phishing links tied to scam activities, with continued monitoring for emerging threats. The company cautioned that exposed order details could be exploited in targeted social engineering campaigns, including fraudulent refund offers, fake firmware-update requests, and impersonation of customer support through phone calls, emails, text messages, physical mail, or unexpected hardware deliveries referencing a SafePal purchase.
Customers are advised to exercise caution with unsolicited communications, refrain from clicking links or scanning QR codes in unexpected messages, and manually enter the official website address rather than following redirects. SafePal reiterated that it never requests seed phrases, private keys, or passwords through any communication channel under any circumstance.
Users who may have disclosed wallet credentials in response to suspicious outreach should treat the affected wallet as compromised, create a new wallet using an official SafePal device or application, transfer assets immediately, and contact the company through its official support channel.
The post SafePal Confirms Order Data Breach Impacting 40,000 Customers, Wallet Credentials And Funds Remain Uncompromised appeared first on Metaverse Post.
