40,000 Affected by SafePal Data Breach: What You Need to Know
SafePal informs 40,000 users of a data breach affecting personal information due to a security flaw.
Overview of the Breach
Crypto hardware wallet provider SafePal has informed approximately 40,000 users that their personal data was exposed in a security incident.
Attackers exploited a flaw in the order-tracking module of a customer order information plugin to access customer records.
The breach affected individuals who placed orders between March 2, 2025, and April 11, 2026, with the compromised dataset including names, addresses, phone numbers, and order histories.
The company confirmed 39,798 customers were impacted.
SafePal disclosed the breach on Sunday, the same day a threat actor began promoting stolen data on a cybercrime forum.
The attacker’s claims align with the company’s findings, specifying the same number of affected users.
SafePal emphasized that no sensitive financial or cryptographic data was compromised, including seed phrases, private keys, wallet passwords, bank details, credit card numbers, or government-issued IDs.
The firm advised users to remain vigilant against requests for sensitive information and to create a new wallet using official SafePal tools if credentials were shared.
Investigation and Response
The incident was first detected in May when the company received a report, initially classified as an isolated issue.
Further investigation revealed a system bug caused order-related data to be retained beyond intended periods.
SafePal initiated a comprehensive review of its order-processing infrastructure in July, confirming the root cause.
The company has resolved the exploited vulnerability, adjusted data retention policies, notified affected users, coordinated with partners to prevent further spread, and engaged a third-party security firm for analysis.
Ongoing Monitoring and Customer Support
SafePal reported removing over 30 fraudulent websites and phishing links linked to the breach, with ongoing monitoring for new threats.
Customers experiencing financial losses are encouraged to contact the company, which is collaborating with blockchain forensic experts.
The firm clarified that this process does not imply liability or compensation commitments, focusing instead on recovery efforts and investigations.
About Author
English