Published on 18 August 2026
An order-tracking plugin – an add-on feature that lets customers track the status of their order – became the gateway to a data breach at SafePal. The company, a provider of crypto wallets, confirms that attackers were able to gain unauthorised access to other customers' order data via an authorisation vulnerability in this feature. According to the company, around 39,798 customers are affected. And although neither passwords nor the cryptographic keys to the wallets are said to have leaked, the incident is a instructive example, particularly for small and medium-sized enterprises (SMEs) – because it shows how a single flawed access check in a seemingly harmless plugin can expose sensitive customer data.
On 16 August 2026, SafePal published a security notice about an incident involving order information. At its core is a so-called authorisation vulnerability – a flaw in the check as to whether a particular user is actually entitled to view a particular record. In the order-tracking function of a plugin that was connected to customer order data, this check could be bypassed under certain conditions. The result: one user could view another customer's order data.
SafePal puts it this way in its own notice:
„Recently, the team identified an authorization flaw in the order-tracking function for a plug-in associated with customer order information. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information.“ (SafePal, Security Update)
According to the company, the specifically disclosed data was:
Explicitly not affected, according to SafePal, were: seed phrases (the recovery words for a crypto wallet), private keys, wallet passwords or other wallet credentials, bank details, payment card numbers and government-issued identification numbers. There is also no indication of compromised access to wallets or balances.
„This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers.“ (SafePal, Security Update)
Affected are orders from the period 2 March 2025 to 11 April 2026. There is a second, separate reason why this period is so long: during the investigation, SafePal discovered a configuration error in the data cleanup process. From September 2025 to April 2026, older order records were retained longer than intended. According to SafePal, this error was not the cause of the unauthorised access, but it extended the affected data period back into March 2025.
Technically, the vulnerability belongs to the class of "Broken Access Control", which ranks first in the OWASP Top 10 catalogue – a recognised list of the most common web security risks. The OWASP project describes the underlying problem as follows:
„Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data.“ (OWASP Top 10:2021, A01 Broken Access Control)
A typical example of this error class: an application displays records via an identifier – such as an order number – but does not reliably check whether the requesting user is also the rightful owner of that record. Change the identifier, and you see someone else's data.
Important for context: SafePal has not published the specific attack vector. Whether it was order number enumeration (systematically trying out numbers), a manipulated API request or a classic IDOR (Insecure Direct Object Reference – direct access to an object via its identifier) is not confirmed. There is no CVE number, no name of the plugin's vendor, no version information and no proof of concept. Anyone claiming it is "definitely" a particular type of attack goes beyond what is publicly documented.
The timeline is only partly known to the exact day. According to its own account, SafePal received a relevant report in early May 2026, initially treated it as an isolated case and later launched a formal investigation:
„We first received a report consistent with this issue in early May, and treated it as an isolated case at the time, but escalated it into a formal security investigation and introduced additional protections.“ (SafePal, Scam-Protection-FAQ)
In July, the company began a full review and rebuild of order processing and confirmed the cause in the process. The vulnerability is said to have been fixed upon discovery; an independent security firm is to validate the fix.
Yes. According to BleepingComputer, during the investigation SafePal determined that an attacker had in fact exploited the vulnerability to steal the order data of around 39,798 customers. An actor offered data with a matching time period and matching number of affected individuals for sale on a cybercrime forum. However, BleepingComputer was unable to independently verify that this actor actually possessed the data.
SafePal explicitly warns of follow-up phishing and reports having removed more than 30 fraudulent websites or phishing links. It is precisely the combination of contact, address and order data that makes targeted fraud attempts credible: fake support, alleged refunds or fake firmware update prompts.
Directly affected are SafePal customers with an order between 2 March 2025 and 11 April 2026. According to SafePal, they were notified individually by email on 16 August 2026.
For other website operators, there is no direct impact from this incident – simply because the name of the plugin, the version and the number of installations are not public. No one can seriously infer from this that any given order-tracking extension would have the same vulnerability. The case is nonetheless relevant for SMEs – as an occasion to critically review their own order, tracking and support integrations.
In addition, the general advice of the BSI applies (not SafePal-specific): „Use strong passwords … Enable two-factor authentication.“
Names, email addresses, postal addresses, phone numbers and order details are personal data. For a comparable incident involving a controller based in Germany or subject to the GDPR, the following therefore applies:
The European Data Protection Board (EDPB) stresses that even incidents that are not subject to mandatory reporting must be documented, and that where information is still missing, a phased (partial) notification can initially be made within the deadline. With the combination of name, contact and residential address, phone number and purchase details, there is a strong indication of high risks – but this is not an automatic legal determination; it depends on the processing, the group of affected individuals and the risk assessment.
On the fine framework: violations of the obligations under Art. 32 to 34 GDPR can, under Art. 83(4) GDPR, be sanctioned with up to EUR 10 million or 2% of worldwide annual turnover of the previous year. The specific amount is determined on a case-by-case basis – among other things by severity, duration, number of affected individuals, damage, technical measures taken and cooperation. In addition, Art. 82 GDPR can give rise to claims for damages in the event of material or non-material damage.
For SafePal itself, neither GDPR jurisdiction nor a specific risk assessment by a supervisory authority can be inferred from the public sources.
Severity: high. The confirmed combination of names, email addresses, delivery addresses, phone numbers and specific purchase data supports credible, targeted social engineering attacks. For buyers of hardware wallets, it can also expose victim profiles and physical contact channels. SafePal reports over 30 removed fraud sites and explicitly warns of fake support, fake firmware updates and alleged refunds.
According to SafePal's information, direct theft from wallets is not evidenced by this data breach alone, since credentials and keys were not affected. However, follow-up phishing remains the central risk. The overall assessment of "high" is an editorial classification based on the confirmed data types and warnings – not an authority's decision.
The case fits into a broader trend: according to the Verizon 2025 Data Breach Investigations Report (DBIR), across industries third parties were involved in 30% of the security breaches examined, and the exploitation of vulnerabilities as an initial attack vector rose by 34%. These figures are not SafePal-specific, but they illustrate why third-party integrations – such as an order-tracking plugin – are increasingly becoming a risk.
That a lack of data protection can become expensive is shown by another, not comparable case: in 2025, the UK's ICO imposed a fine of GBP 2.31 million on 23andMe for inadequate security measures following a cyberattack. That case concerned particularly sensitive genetic data and is not directly transferable to SafePal – but it underlines the regulatory relevance of deficient technical protective measures.
The SafePal incident is a textbook example of how an inconspicuous add-on feature – order tracking – becomes a data breach via a flawed access check. Around 39,798 customers are affected; contact, address and order data leaked. According to the company, cryptographic keys and passwords were not affected – the real risk now lies in targeted phishing.
Are you a SafePal customer? Check via the official Scam Protection page whether your order is affected, and treat every unsolicited message as potential phishing. Never disclose your seed phrase or private keys.
Do you run a shop or a customer portal yourself? Take this case as an occasion to inventory your own order, tracking and support integrations, test access controls server-side, enable logging and alerting, and keep your data breach response plan ready. Because as this case shows: it is not the spectacular flaw in your own code, but the silent error in a third-party extension that is enough to expose customer data – and to start the GDPR clock ticking.