SAFEPAL disclosed on 17 August 2026 that a flaw in its order‑tracking plugin exposed the personal details of roughly 39 798 customers, with the leak dating back to early March 2025 and persisting until mid‑April 2026. The compromised data included names, email addresses, phone numbers, shipping addresses and order information, while private keys and payment credentials remained secure. The incident was first advertised on a cybercrime forum before the vendor went public.
The vulnerability lay in the plugin’s API endpoint, which did not require authentication and allowed unauthenticated users to retrieve order records by manipulating simple parameters. No CVE identifier has been assigned to the flaw, but the issue stemmed from insufficient access controls on a component designed to display shipment status for completed purchases. Versions of the plugin deployed between the stated dates were affected, enabling attackers to harvest bulk customer data.
Attackers appear to have enumerated order identifiers or used wildcard queries to scrape the entire dataset, a technique that required no sophisticated tools and could be automated with basic scripts. The harvested information was later posted on a hacking forum, where it was offered for sale or use in social‑engineering campaigns. Security analysts noted that the exposure window overlapped with a period of increased plugin usage as SafePal expanded its e‑commerce integrations.
Although no threat actor has been definitively linked to the breach, the public posting of the data raises the risk of phishing attempts targeting affected users, particularly messages that masquerade as SafePal support and request wallet details. The breach underscores the supply‑chain risk posed by third‑party components in cryptocurrency services, where a seemingly benign plugin can become a conduit for large‑scale data loss.
SafePal has notified all potentially impacted individuals, patched the vulnerable plugin and implemented additional monitoring to detect any further anomalous activity. The company advises customers to treat any unexpected communication about private keys or wallet recovery with suspicion and to consider generating new wallet addresses if they fear their information may have been misused. Users are also encouraged to enable any available multi‑factor authentication on associated accounts and to review recent transaction histories for irregularities.
Organisations that rely on similar plugins should conduct regular security assessments of third‑party components, enforce the principle of least privilege on APIs and maintain detailed access logs to spot unauthorised queries. Prompt disclosure, swift patching and clear user guidance remain essential steps in limiting the fallout from such incidents and preserving trust in digital asset platforms.