Safepal, a hardware wallet manufacturer, has disclosed a data breach that exposed customer information for 39,798 people. The incident ran from March 2, 2025 to April 11, 2026, caused by a malfunctioning order-tracking plugin that let unauthorized actors access customer data. Affected users now face a higher risk of phishing attacks and fraudulent phone calls.
A faulty plugin
The breach stemmed from a plugin used to track orders. It malfunctioned, leaving a gap that unauthorized threat actors exploited. The company did not specify what kind of data was taken, but the disclosure ties the exposure directly to customer records linked to those orders.
Safepal said the incident is a new customer data breach, though it offered no timeline for when it discovered the problem. The disclosure does not say how the attackers gained entry beyond the plugin failure, or whether any of the stolen data has been used.
Phishing and fraud risk
With customer information in hand, the affected users are vulnerable to targeted phishing emails and fake phone calls. Hardware wallet owners are a common target for social engineering because a successful scam can drain crypto holdings. The company's warning suggests that the exposed data could include contact details and order history, enough for scammers to sound convincing.
Safepal has not announced any specific protective measures beyond the disclosure. Customers who believe they were affected should be cautious with unsolicited messages asking for passwords, seed phrases, or payment details. Legitimate support teams do not ask for that information.
Disclosure and next steps
The company has not said whether it notified law enforcement or offered credit monitoring. It also hasn't clarified if the breach is fully contained or if more customers could be affected. The disclosure focuses on the 39,798 customers whose data was accessed during the 13-month window.
For now, the safest move for anyone who bought from Safepal during that period is to assume their data is out there. Change passwords, enable two-factor authentication, and treat any unexpected call or email with suspicion. Safepal has yet to announce further steps, leaving affected users waiting on more details about what exactly was taken and what they should do next.
