An authorization vulnerability in a plug-in used by SafePal, a hardware wallet manufacturer, led to the exposure of sensitive data belonging to nearly 40,000 customers. Affected information included names, email addresses, shipping details, and purchase information, but did not compromise wallet credentials or financial data, according to the company.
Details of the Security Incident
SafePal notified all impacted customers via email on August 16, using the address [email protected], with a subject line indicating the breach. The issue, which did not involve wallet passwords or financial details, allowed unauthorized access to order information under specific circumstances. The flaw was present in orders placed between March 2, 2025, and April 11, 2026, though the company has not specified when the unauthorized access commenced or ended.
Potential Risks for Affected Customers
Customers whose information was exposed are at risk of receiving fraudulent communications, including phone calls, emails, and fake customer support messages. SafePal urged caution and advised users to treat any unexpected contact referencing their purchases with suspicion. Importantly, the breach did not include wallet addresses or balances.
Company’s Response and Remedial Measures
In response to the breach, SafePal has implemented several security measures. These include fixing the flaw, reducing data retention to 90 days, and purging affected records from active servers. The company is also engaging an independent security firm to review its systems and has contacted third-party partners to ensure the issue has not propagated.
Furthermore, SafePal has addressed fraudulent activities by taking down over 30 fake websites and phishing links. A status-check page has been introduced for customers to verify their order status, and a dedicated support channel has been established for further assistance.
Future Outlook and Customer Advisories
While SafePal has emphasized that customers do not need to move assets solely due to this incident, it advises anyone who entered a seed phrase or private key in response to suspicious communications to treat their wallet as compromised. The company is also working with on-chain asset-tracing specialists to investigate any potential losses linked to the data exposure.
Though no financial losses have been confirmed, SafePal encourages customers who suspect a financial impact to contact their support channel. As the company continues its investigation and system improvements, maintaining customer trust and security remains a top priority.
