SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal, a hardware wallet maker, has disclosed an authorization flaw in an order-tracking plug-in that exposed the data of nearly 40,000 customers. The exposed records included names, email addresses, shipping addresses, phone numbers, and purchase details, but did not i…
Intelligence analysis by Llama
SafePal has disclosed an authorization flaw in an order-tracking plug-in that exposed the data of nearly 40,000 customers. The company has taken steps to fix the issue and has introduced additional security measures.
Imagine you bought something online, and the company storing your order information got hacked. They're saying that the hackers got your name, email, and address, but not your password or any money. The company is fixing the problem and making sure it doesn't happen again.
Analysis
Vulnerability Details
SafePal has disclosed an authorization flaw in an order-tracking plug-in that exposed the data of nearly 40,000 customers. The flaw allowed unauthorized access to another customer's order information, and the affected orders were placed between March 2, 2025, and April 11, 2026. The exposed records included names, email addresses, shipping addresses, phone numbers, and purchase details, but did not include wallet credentials or financial information.
Impact
The incident has raised concerns about the potential consequences of a security breach. SafePal has warned that affected customers may face "fraudulent phone calls, emails, text messages, letters, refund offers, firmware-update requests, fake customer-support communications." The company has also stated that the data does not include wallet addresses, balances, or any indication of what a customer holds.
Response
SafePal has taken steps to fix the issue and has introduced additional security measures. The company has retained personal information in the relevant order-processing environment for 90 days, subject to applicable legal requirements. Affected records have been purged from active servers, with a secured offline backup kept solely to support potential investigations. An independent third-party security firm is being engaged to validate the fix and review order-processing systems more broadly. Third-party logistics and fulfillment partners have been contacted to confirm the issue had not spread within their systems. Over 30 fraudulent websites and phishing links "tied to the scam activities" have been taken down. A status-check page using an order ID number and shipping country has been published, alongside a dedicated support channel.
Comparison
This incident is similar to a previous breach disclosed by Ledger in December 2020, where a database published online held approximately 272,000 detailed records with postal addresses, names, and phone numbers. Researchers Svetlana Abramova and Rainer Böhme later surveyed 104 of those customers for USENIX Security '23 and found spam, scams, phishing, and two reports of tampered devices.
Key points
- SafePal has disclosed an authorization flaw in an order-tracking plug-in that exposed the data of nearly 40,000 customers.
- The exposed records included names, email addresses, shipping addresses, phone numbers, and purchase details, but did not include wallet credentials or financial information.
- SafePal has taken steps to fix the issue and has introduced additional security measures.
- The company has retained personal information in the relevant order-processing environment for 90 days, subject to applicable legal requirements.
- Affected records have been purged from active servers, with a secured offline backup kept solely to support potential investigations.
SafePal's swift response to the incident and their introduction of additional security measures are positive steps towards protecting customer data. The company's engagement of an independent third-party security firm to validate the fix and review order-processing systems more broadly is also a reassuring move.
The potential consequences of a security breach, such as fraudulent phone calls, emails, text messages, letters, refund offers, firmware-update requests, and fake customer-support communications, are a realistic downside risk. The fact that the data does not include wallet addresses, balances, or any indication of what a customer holds does not alleviate the concern.
