SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

Hardware wallet maker SafePal acknowledged a data breach on August 16, 2026: the names, email addresses, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases, private keys and payment data were not affected, according to the company. Anyone who ordered a device between March 2, 2025 and April 11, 2026 should check now, because the combination of a home address and the knowledge that someone there "owns a hardware wallet" is precisely what makes targeted fraud possible. The company has notified affected customers by email and published a lookup tool that establishes, from the order number, whether a given order sits in the leak. It is the second incident of its kind in the industry within two weeks. What Exactly Happened in the SafePal Data Breach The cause, according to SafePal, was an authorization flaw in a plugin used for order tracking. An authorization flaw means an application checks whether someone is logged in, but not whether that person is entitled to see the data being requested. Under certain conditions, another customer's order could be viewed through it. A second, unrelated fault compounded the problem. According to resear...