SafePal Data Breach: Order-Tracking Plug-in Authorization Flaw Exposes 39,798 Crypto Wallet Customers' PII, Fuels Phishing Campaign

SafePal Data Breach (TL-2026-2032) is a medium-severity data breach, first published 2026-08-16. It has no confirmed attribution, affects SafePal Order-Tracking Plug-in / Order-Processing Pipeline, maps to 10 MITRE ATT&CK techniques (T1036.005, T1119, T1190), and is covered by 9 detection rules and 4 indicators of compromise.

Key facts for TL-2026-2032

Threat ID
TL-2026-2032
Severity
MEDIUM
Status
ACTIVE
Category
DATA_BREACH
First published
2026-08-16
Last reviewed
2026-08-16
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, financial-services, consumer-technology
Target regions
Global
Detection rules
9
Indicators of compromise
4

Crypto hardware wallet vendor SafePal disclosed an authorization flaw (IDOR) in the order-tracking function of a plug-in that let customers view other customers' order records, exposing names, emails, shipping addresses, phone numbers, and purchase data for 39,798 customers who ordered between March 2, 2025 and April 11, 2026. A separate data-retention configuration error kept the records live longer than intended, a threat actor is now advertising the dataset for sale on a cybercrime forum, and the leaked contact/order details are fueling an active vishing/phishing campaign impersonating SafePal support. Wallet seed phrases, private keys, passwords, and payment data were not exposed.

How SafePal Data Breach works

SafePal, a Binance-backed non-custodial hardware and software cryptocurrency wallet vendor, disclosed on August 16, 2026 that an authorization flaw in the order-tracking function of a plug-in used by its order-processing system allowed any customer to view another customer's order record by manipulating the order identifier — a classic Insecure Direct Object Reference (IDOR) / broken access control failure rather than a credential compromise. A separate configuration error caused the affected records to remain in active systems well past their intended retention period, compounding the exposure between roughly September 2025 and April 2026.

SafePal states it first received a breach-consistent customer report in early May 2026 but treated it as an isolated case rather than a systemic flaw. Public complaints describing phishing contacts that referenced accurate SafePal order details surfaced on Reddit and Trustpilot on July 3-4, 2026. SafePal began a full review and rebuild of its order-processing pipeline in July 2026, during which the authorization flaw was confirmed as the root cause. The company disclosed the incident on August 16, 2026, emailing all affected customers individually from security@safepal.com and publishing a security-update advisory.

Approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026 had their name, email address, shipping address, phone number, and purchase details exposed. SafePal states that wallet seed phrases, private keys, passwords, bank account information, payment card numbers, and government-issued identification were not exposed, and it has found no evidence that the flaw itself compromised access to any SafePal wallet or funds.

A threat actor is advertising the stolen 39,798-record dataset for sale on a cybercrime forum, offering order ID and shipping-country fields as proof of possession (not independently verified by researchers). Separately, victims report a coordinated social-engineering campaign in which callers and emailers impersonate SafePal support, cite the victim's real name, address, phone, email, and order details for credibility, and direct them to fraudulent domains such as safepal.support to request a bogus 'hardware wallet replacement' or firmware update — the classic pretext used to eventually solicit a wallet seed phrase. A second, independently-flagged typosquat domain, safepal.com.co, impersonates the official SafePal wallet service and appears in both the Phishing-Database and Solflare wallet blocklist trackers, indicating the impersonation campaign extends beyond the single domain SafePal has publicly named.

SafePal's remediation includes fixing the authorization flaw and adding access-control checks, purging personal data from active servers (retaining only encrypted offline copies for law enforcement), reducing order-processing data retention to 90 days, engaging an independent third-party security firm to validate the fix and review the broader system, taking down more than 30 fraudulent websites and phishing links, and launching an order ID + shipping-country verification tool so customers can check their exposure status. SafePal advises affected customers that they do not need to replace their wallets or move funds unless they already shared a seed phrase with a phisher, and to treat any unsolicited SafePal-branded call, DM, or email as fraudulent.

MITRE ATT&CK techniques used in TL-2026-2032

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice

Resource Development

T1583.001 Domains

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Affected products and versions in SafePal Data Breach

  • SafePal — Order-Tracking Plug-in / Order-Processing Pipeline
    Vulnerable versions: Web order-tracking system active for orders placed 2025-03-02 through 2026-04-11
    Fixed in: Authorization flaw patched and additional access controls added as of the 2026-08-16 disclosure; data retention capped at 90 days

Remediation for SafePal Data Breach

Patches

  • SafePal patched the order-tracking plug-in authorization flaw and added additional access-control checks (per the August 16, 2026 security-update advisory)

Immediate actions

  • Verify exposure status via SafePal's official order ID + shipping-country lookup tool at safepal.com/en/scam-protection
  • Do not click links in unsolicited SafePal-branded emails, texts, or calls; manually type safepal.com instead of following any link
  • Treat any inbound call, DM, or email claiming to be SafePal support as fraudulent — SafePal states it never calls or DMs customers
  • Never enter a wallet seed phrase, private key, or password on any third-party 'support', 'replacement', or 'verification' site
  • Report suspected SafePal-impersonation domains (e.g., safepal.support, safepal.com.co) to registrars/browsers and to SafePal's dedicated support channel

Workarounds

  • No user-side workaround exists for the underlying flaw; SafePal has already remediated it server-side as of disclosure

Longer-term hardening

  • Enforce object-level authorization checks (verify record ownership, not just authentication) on every order-tracking/order-lookup endpoint to prevent IDOR
  • Apply strict, automatically-enforced data-retention limits (SafePal reduced this to 90 days) with monitoring to catch retention-policy failures like the one that compounded this breach
  • Commission independent third-party security review of third-party e-commerce/order-processing plug-ins both before and after integration
  • Deploy anomaly detection on order-lookup APIs for sequential or bulk enumeration patterns consistent with mass IDOR scraping

Weaknesses (CWE) in SafePal Data Breach

CWE-639, CWE-284, CWE-459

Timeline of SafePal Data Breach

  • Earliest order date within the affected window; SafePal's order-tracking plug-in authorization flaw begins exposing customer order records from this point.
  • Latest order date within the affected window disclosed by SafePal; orders placed through this date fall within the 39,798-customer exposure set.
  • SafePal receives its first breach-consistent customer report but treats it as an isolated incident rather than a systemic authorization flaw.
  • SafePal begins a full review and rebuild of its order-processing pipeline, during which the authorization flaw is confirmed as the root cause.
  • Customers post complaints on Reddit and Trustpilot describing phishing contacts that referenced accurate SafePal order details.
  • BleepingComputer reports a threat actor advertising the 39,798-record stolen dataset for sale on a cybercrime forum, offering order ID and shipping-country fields as proof of possession.
  • SafePal reduces its order-processing data-retention policy to 90 days as a remediation measure.
  • SafePal reports it has identified and taken down more than 30 fraudulent websites and phishing links tied to the incident.
  • SafePal launches an order ID + shipping-country lookup tool at safepal.com/en/scam-protection so customers can check their exposure status.
  • SafePal emails all affected customers individually from security@safepal.com.
  • SafePal publicly discloses the breach via a security-update blog post and X post, confirming 39,798 affected customers and the March 2, 2025 - April 11, 2026 exposure window.

Sources cited for SafePal Data Breach

Threats related to SafePal Data Breach

Detection coverage for TL-2026-2032

As of 2026-08-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2032 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats