SafePal reported a data breach affecting 39 798 people. The cause was a vulnerability in the order tracking system: due to an error, it was possible to access data from other people’s purchases. Names, emails, phone numbers, delivery addresses, and order information were leaked online.
However, the cryptocurrency wallets themselves were not hacked. Seed phrases, private keys, passwords, bank cards, and user funds were not affected by the breach.
Why the breach is dangerous
The main risk now — is phishing. Scammers obtained not only users’ phone numbers, e-mail addresses, and delivery addresses, but also information about their purchases. With this information, it is much easier to impersonate a SafePal employee and convince a wallet owner that they are actually being contacted or called by support.
For example, scammers may refer to a real purchase and offer to check the wallet after the breach, confirm the seed phrase, or visit a fake website.
The first complaints appeared even before SafePal’s official announcement. Users reported calls from alleged company employees who knew their names, addresses, and order details.
SafePal reports that it has already identified and removed more than 30 phishing websites and links related to this incident. Information about the sale of the customer database has also appeared online, but there is currently no independent confirmation that it specifically contains data from this breach.
What SafePal users should do
SafePal has already fixed the vulnerability, added additional security measures, and hired a third-party company to verify the fixes.
The company separately reminds users that SafePal employees never request a seed phrase or private key. Therefore, it is now especially important for users whose data was affected by the breach to carefully check emails, calls, and websites where they are asked to confirm their wallet details.
SafePal has also launched a check using the order number and delivery country so customers can find out whether they were affected by the breach. You can check an order on the dedicated SafePal Scam Protection page.
