SafePal disclosed on Aug. 16 that a flaw in an order-tracking plug-in exposed the personal data of 39,798 customers, including names, email addresses, shipping addresses, phone numbers and purchase details for orders placed between March 2, 2025 and April 11, 2026. The stolen data pairs home addresses with proof of hardware wallet ownership, making it a targeting list for phishing and physical robbery. A threat actor is already advertising the records for sale on a cybercrime forum. This breach comes three days after Trezor disclosed that a breach at fulfillment partner ShipMonk exposed data for 13,689 of its customers. SafePal has notified affected customers, took down over 30 fraudulent websites and reduced personal data retention to 90 days.
Source: Read the original article
