SafePal Data Breach: Order-Tracking Plug-in Authorization Flaw Exposes 39,798 Crypto Wallet Customers' PII, Fuels Phishing Campaign
SafePal Data Breach (TL-2026-2032) is a medium-severity data breach, first published 2026-08-16. It has no confirmed attribution, affects SafePal Order-Tracking Plug-in / Order-Processing Pipeline, maps to 10 MITRE ATT&CK techniques (T1036.005, T1119, T1190), and is covered by 9 detection rules and 4 indicators of compromise.
Key facts for TL-2026-2032
- Threat ID
- TL-2026-2032
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-08-16
- Last reviewed
- 2026-08-16
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, financial-services, consumer-technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
Crypto hardware wallet vendor SafePal disclosed an authorization flaw (IDOR) in the order-tracking function of a plug-in that let customers view other customers' order records, exposing names, emails, shipping addresses, phone numbers, and purchase data for 39,798 customers who ordered between March 2, 2025 and April 11, 2026. A separate data-retention configuration error kept the records live longer than intended, a threat actor is now advertising the dataset for sale on a cybercrime forum, and the leaked contact/order details are fueling an active vishing/phishing campaign impersonating SafePal support. Wallet seed phrases, private keys, passwords, and payment data were not exposed.
How SafePal Data Breach works
SafePal, a Binance-backed non-custodial hardware and software cryptocurrency wallet vendor, disclosed on August 16, 2026 that an authorization flaw in the order-tracking function of a plug-in used by its order-processing system allowed any customer to view another customer's order record by manipulating the order identifier — a classic Insecure Direct Object Reference (IDOR) / broken access control failure rather than a credential compromise. A separate configuration error caused the affected records to remain in active systems well past their intended retention period, compounding the exposure between roughly September 2025 and April 2026.
SafePal states it first received a breach-consistent customer report in early May 2026 but treated it as an isolated case rather than a systemic flaw. Public complaints describing phishing contacts that referenced accurate SafePal order details surfaced on Reddit and Trustpilot on July 3-4, 2026. SafePal began a full review and rebuild of its order-processing pipeline in July 2026, during which the authorization flaw was confirmed as the root cause. The company disclosed the incident on August 16, 2026, emailing all affected customers individually from security@safepal.com and publishing a security-update advisory.
Approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026 had their name, email address, shipping address, phone number, and purchase details exposed. SafePal states that wallet seed phrases, private keys, passwords, bank account information, payment card numbers, and government-issued identification were not exposed, and it has found no evidence that the flaw itself compromised access to any SafePal wallet or funds.
A threat actor is advertising the stolen 39,798-record dataset for sale on a cybercrime forum, offering order ID and shipping-country fields as proof of possession (not independently verified by researchers). Separately, victims report a coordinated social-engineering campaign in which callers and emailers impersonate SafePal support, cite the victim's real name, address, phone, email, and order details for credibility, and direct them to fraudulent domains such as safepal.support to request a bogus 'hardware wallet replacement' or firmware update — the classic pretext used to eventually solicit a wallet seed phrase. A second, independently-flagged typosquat domain, safepal.com.co, impersonates the official SafePal wallet service and appears in both the Phishing-Database and Solflare wallet blocklist trackers, indicating the impersonation campaign extends beyond the single domain SafePal has publicly named.
SafePal's remediation includes fixing the authorization flaw and adding access-control checks, purging personal data from active servers (retaining only encrypted offline copies for law enforcement), reducing order-processing data retention to 90 days, engaging an independent third-party security firm to validate the fix and review the broader system, taking down more than 30 fraudulent websites and phishing links, and launching an order ID + shipping-country verification tool so customers can check their exposure status. SafePal advises affected customers that they do not need to replace their wallets or move funds unless they already shared a seed phrase with a phisher, and to treat any unsolicited SafePal-branded call, DM, or email as fraudulent.
MITRE ATT&CK techniques used in TL-2026-2032
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Initial Access
T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information
Impact
Affected products and versions in SafePal Data Breach
- SafePal — Order-Tracking Plug-in / Order-Processing Pipeline
Vulnerable versions: Web order-tracking system active for orders placed 2025-03-02 through 2026-04-11
Fixed in: Authorization flaw patched and additional access controls added as of the 2026-08-16 disclosure; data retention capped at 90 days
Remediation for SafePal Data Breach
Patches
- SafePal patched the order-tracking plug-in authorization flaw and added additional access-control checks (per the August 16, 2026 security-update advisory)
Immediate actions
- Verify exposure status via SafePal's official order ID + shipping-country lookup tool at safepal.com/en/scam-protection
- Do not click links in unsolicited SafePal-branded emails, texts, or calls; manually type safepal.com instead of following any link
- Treat any inbound call, DM, or email claiming to be SafePal support as fraudulent — SafePal states it never calls or DMs customers
- Never enter a wallet seed phrase, private key, or password on any third-party 'support', 'replacement', or 'verification' site
- Report suspected SafePal-impersonation domains (e.g., safepal.support, safepal.com.co) to registrars/browsers and to SafePal's dedicated support channel
Workarounds
- No user-side workaround exists for the underlying flaw; SafePal has already remediated it server-side as of disclosure
Longer-term hardening
- Enforce object-level authorization checks (verify record ownership, not just authentication) on every order-tracking/order-lookup endpoint to prevent IDOR
- Apply strict, automatically-enforced data-retention limits (SafePal reduced this to 90 days) with monitoring to catch retention-policy failures like the one that compounded this breach
- Commission independent third-party security review of third-party e-commerce/order-processing plug-ins both before and after integration
- Deploy anomaly detection on order-lookup APIs for sequential or bulk enumeration patterns consistent with mass IDOR scraping
Weaknesses (CWE) in SafePal Data Breach
CWE-639, CWE-284, CWE-459
Timeline of SafePal Data Breach
- Earliest order date within the affected window; SafePal's order-tracking plug-in authorization flaw begins exposing customer order records from this point.
- Latest order date within the affected window disclosed by SafePal; orders placed through this date fall within the 39,798-customer exposure set.
- SafePal receives its first breach-consistent customer report but treats it as an isolated incident rather than a systemic authorization flaw.
- SafePal begins a full review and rebuild of its order-processing pipeline, during which the authorization flaw is confirmed as the root cause.
- Customers post complaints on Reddit and Trustpilot describing phishing contacts that referenced accurate SafePal order details.
- BleepingComputer reports a threat actor advertising the 39,798-record stolen dataset for sale on a cybercrime forum, offering order ID and shipping-country fields as proof of possession.
- SafePal reduces its order-processing data-retention policy to 90 days as a remediation measure.
- SafePal reports it has identified and taken down more than 30 fraudulent websites and phishing links tied to the incident.
- SafePal launches an order ID + shipping-country lookup tool at safepal.com/en/scam-protection so customers can check their exposure status.
- SafePal emails all affected customers individually from security@safepal.com.
- SafePal publicly discloses the breach via a security-update blog post and X post, confirming 39,798 affected customers and the March 2, 2025 - April 11, 2026 exposure window.
Sources cited for SafePal Data Breach
- SafePal data breach impacts 39,798 customers, stolen info for sale
- Unauthorized Access To A Subset Of Customer Order Information
- SafePal Scam Protection / Order Verification Tool
- Wallet provider SafePal says data breach exposed personal info of nearly 40,000 customers
- Safepal security vulnerability exposes data of 39,798 customers
- Breach at Crypto Wallet Company Called 'SafePal' Exposes 39,798 Customers
- Binance-Backed SafePal Reveals Data Breach: 40,000 Users' Info Exposed
- Binance-Backed SafePal Data Leak Sparks Phishing Fears for 40K Buyers
Threats related to SafePal Data Breach
- ShipMonk Fulfillment Partner Breach Exposes Data of 13,689 Trezor Customers
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths (UNC6040/UNC6240/UNC6395/GRUB1/Storm-3138)
- AI-Accelerated Phone Scam (Vishing/TOAD) Campaigns Impersonating Amazon, Microsoft, PayPal, Norton, GitHub, Canva, Geek Squad, Temu, Target and the FTC
- Balonx Sistema PhaaS Campaign — AI Voice Calls and Fake Banking Pages Targeting Mexican Financial Institutions
- Proofpoint 2026 AI-Era Ransomware Report: 65% of Victims Report AI Increased Attack Effectiveness
- Harvard/Meta Study Quantifies AI Voice-Phishing (Vishing) Persuasiveness Gap: 16.5% Compliance, 70.3% Detection, and Profitable Economics for Attackers
Detection coverage for TL-2026-2032
As of 2026-08-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2032 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.