SafePal breach exposes data of 39,800 customers

TLDR

SafePal (SFP) has confirmed a data breach that exposed order information for roughly 39,800 hardware wallet customers, but no crypto funds or private keys were directly compromised.

1. The breach stemmed from an authorization flaw in an order-tracking plugin, leaking names, emails, addresses, phone numbers and purchase details for orders between March 2025 and April 2026.
2. SafePal says wallet seed phrases, private keys, passwords and payment details were not accessed, so the key risk is targeted phishing and impersonation rather than immediate loss of funds.
3. Affected users are being emailed and can use a verification tool on SafePals site; going forward, the main priorities are watching for scams and never sharing recovery phrases or private keys.

Deep Dive

1. What Was Exposed And How

SafePal disclosed that about 39,798 customer records were accessed due to an authorization flaw in a plug?in used to track orders, allowing attackers to view other customers order details by manipulating order numbers. The affected window covers orders placed between 2 Mar 2025 and 11 Apr 2026, and includes names, email addresses, physical/shipping addresses, phone numbers and detailed purchase information such as which SafePal products were ordered, as reported by CoinDesk.

SafePal also acknowledged a separate failure in its data-cleanup process that left older order data stored longer than intended, widening the period of exposed records, according to crypto.news. The vulnerability itself has been patched and the impacted data removed from active e?commerce servers, with only an encrypted offline copy kept for investigations.

2. Impact On Wallet And Funds

SafePal stresses that the breach hit its e?commerce/order system, not the wallet infrastructure. The company states that seed phrases, private keys, wallet passwords, payment card numbers, bank account information and government IDs were not exposed and that hardware wallets and cold storage remain isolated from the online order system, as detailed by CoinDesk.

The main risk is social engineering. Attackers can use real names, addresses and purchase details to craft convincing fake support emails, websites or messages that try to trick users into revealing their recovery phrases or authorizing malicious transactions.

3. Practical Steps For Users

SafePal says it has emailed each affected customer and deployed a tool on its website where buyers can check if their order was impacted using order number and shipping country, per crypto.news. It has also shortened personal-data retention in the order system to 90 days and taken down more than 30 phishing sites linked to the incident.

For users, key defensive steps are: never share your 12/24?word recovery phrase, PIN or private keys with anyone, even if they claim to be SafePal support; treat any unsolicited requests for verification or security checks as suspicious; and independently navigate to official SafePal domains rather than clicking links in unexpected emails. If you have already entered your seed phrase or private key on a suspicious site or in a questionable chat, consider that wallet compromised and move assets to a new wallet you control.

Conclusion

This SafePal breach is serious from a privacy perspective because it exposes detailed customer identity and purchase data, but current evidence suggests wallet encryption and private keys were not directly accessed. The real risk is more believable phishing aimed at SafePal users, so the most impactful response is not panic selling or abandoning the wallet, but tightening operational security, verifying all communications carefully and keeping recovery phrases strictly offline and private.