Hackers exploited a vulnerability in the order-tracking function of a customer order information plugin used by SafePal, a crypto hardware wallet provider, to access personal data of approximately 39,798 customers. The compromised data includes names, addresses, email addresses, phone numbers, and order details for orders placed between March 2, 2025, and April 11, 2026. SafePal confirmed that sensitive information such as seed phrases, private keys, wallet passwords, bank account details, payment card numbers, and government-issued IDs were not compromised. The breach was disclosed after a threat actor advertised the stolen data on a cybercrime forum. SafePal investigated the incident starting in May 2026, discovered a bug causing extended data retention, and began a full review and rebuild of their order-processing pipeline. The company has remediated the vulnerability, notified impacted customers, contacted partners to prevent propagation, and is monitoring for related phishing and scam activities.

The breach exposed personal identifying information and order details of nearly 40,000 SafePal customers, which could facilitate targeted phishing or social engineering attacks. However, critical wallet security credentials and financial information were not compromised, reducing the risk of direct asset theft through this breach. Customers remain at risk of scams attempting to obtain wallet seed phrases or private keys through fraudulent communications. The incident may impact customer trust and requires vigilance against phishing attempts.

SafePal has addressed the vulnerability exploited in the order-tracking plugin and tightened data retention policies. Affected customers have been notified and advised to be cautious of suspicious communications requesting seed phrases or private keys. Customers who have shared such sensitive information in response to scams should consider their wallets compromised, create new wallets using official SafePal devices or applications, and transfer assets immediately. SafePal is actively monitoring and taking down fraudulent websites and phishing links related to the breach. No further action is required beyond following SafePal's guidance and maintaining vigilance against phishing.