Emerging ThreatsData Breaches

SafePal Breach Exposes 40,000 Customers to Phishing Risk

Analyst 207||Source: InfoSecMag
Blurred shipping label on a surface with rows of packages in the background.

"This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers," SafePal clarified.

Scale and timeline: 39,798 customers, orders placed between 2 March 2025 and 11 April 2026

SafePal told customers on 16 August that order information linked to 39,798 people was exposed in a recent breach. The company said the incident affected customers who placed orders between 2 March 2025 and 11 April 2026. The exposed records, SafePal said, contained names, email and shipping addresses, phone numbers and purchase details.

What was exposed — and what SafePal says was not

According to SafePal, the stolen data is limited to order-related personal information: names, emails, shipping addresses, phone numbers and purchase details. The company explicitly stated that the incident did not involve seed phrases, private keys, wallet passwords or other wallet credentials, nor bank account information, payment card numbers, or government‑issued identification numbers.

SafePal also said it "never requests, collects, processes or stores such information from customers" and reported finding "no evidence" that the breach itself compromised access to SafePal wallets or funds.

Cause and remediation: an order‑tracking plug‑in vulnerability

SafePal attributed the breach to a defect in an order‑tracking function for a plug‑in. The firm said the flaw "under certain conditions" allowed unauthorized access to another customer's order information. SafePal said it remediated the issue upon discovery and "introduced additional security measures."

Phishing, fraud and takedowns: the immediate risks and actions

SafePal warned customers to expect a range of fraudulent approaches that attempt to convert exposed order data into further compromise. The company listed likely vectors customers should watch for: "fraudulent phone calls, emails, text messages, letters, refund offers, firmware‑update requests, fake customer‑support communications" and other solicitations designed to obtain wallet credentials or additional personal information.

The firm reported it had already taken down more than 30 fraudulent websites and phishing links associated with the incident. Screenshots posted to X show an individual offering the stolen data for sale, although SafePal noted those claims have not been verified.

SafePal has published a dedicated page for reporting scams and opened a support channel for affected customers. It issued direct guidance to users, including:

  • Never share your seed phrase, private key, or password with anyone, even if they claim to be a SafePal employee.
  • Don’t click links or scan QR codes in unsolicited emails, text messages, or letters claiming to be from SafePal.
  • Type the SafePal web address manually into the browser rather than following a redirected link, including any link that appears to come from this notice.
  • Be on the lookout for any suspicious communication or impersonation, whether by phone, post or in person.
  • Report anything suspicious, including messages, calls, letters or websites.

What this means for technologists, affected customers, and takedown teams

  • Technologists and security teams: verify that the remediation to the order‑tracking plug‑in fully prevents unauthorized cross‑customer access and review plug‑in and API controls tied to order information.
  • Affected customers: follow SafePal's reporting page and support channel, heed the company's advice to never share wallet credentials and avoid unsolicited links or QR codes.
  • Fraud‑response and takedown teams: continue monitoring and removing phishing domains and links — SafePal reports more than 30 such takedowns already — and assess the unverified sale claims appearing on X.

SafePal's public account of the incident concentrates on exposed order data and immediate fraud risks. The company asserts no wallet credentials or payment data were taken and says it has remediated the plug‑in flaw and added security measures. Still, the presence of nearly 40,000 impacted orders and reports of data being posted for sale sustain a tangible risk of targeted phishing and social‑engineering efforts; the claims of a sale on X remain unverified, and the effectiveness of the firm's additional security measures will be judged by whether further fraudulent activity appears.

https://www.infosecurity-magazine.com/news/safepal-data-breach-tens-thousands/

Data BreachEmerging ThreatsSupply Chain RiskCustomer Data ExposureE-commerce SecuritySafepalPhishing Risk
Related Intelligence

Continue Reading

Person sits at desk with laptop and papers in a neutral setting.

Apple Alerts 110 Countries to Mercenary Spyware Threats

Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.

Analyst 207
Laptop on a desk in a neutral office setting with blurred screen.

CTM360 Exposes Global Recruitment Phishing Campaign Using Browser-in-the-Browser Traps

Beware of a sneaky recruitment phishing scam that used fake interview pages and a clever Browser-in-the-Browser trick to steal Google and Facebook credentials from over 3,000 unsuspecting victims in just two months. This cunning attack even fooled multi-factor authentication, putting countless users at risk.

Analyst 207
Modern computer workstation with laptop and peripherals near a window.

Mustang Panda Upgrades CoolClient Backdoor with Signed Windows Rootkit

Meet the upgraded CoolClient backdoor, now armed with a signed Windows rootkit that lets it hide in plain sight, and a closer look reveals it's linked to the notorious HoneyMyte threat group, aka Mustang Panda. This sneaky malware has been targeting victims in Myanmar, Mongolia, Pakistan, and more.

Analyst 207
A cluttered computer workstation with a blank laptop screen sits unoccupied in a dimly lit server room with rows of…

Hackers Exploit Dropcatch Domains to Redirect Traffic to Scams and Malware

Hackers are exploiting "dropcatch domains" - previously owned domains that are re-registered by new owners - to redirect traffic to scams and malware, taking advantage of the reputation and connections they inherit from their past life. With nearly one in five new domain registrations being a re-registration of an expired name, the threat is more widespread than you might think.

Analyst 207