Ethical Hacking News
SafePal, a manufacturer of hardware wallets, has disclosed a significant flaw in one of its order-tracking plug-ins, which exposed the sensitive data of nearly 40,000 customers. The company has taken steps to address the issue, including the implementation of new security measures and the retention of personal information in the relevant order-processing environment to 90 days. While wallet credentials or financial information were not compromised, the exposed records could potentially be used for fraudulent purposes.
A significant flaw was discovered in SafePal's order-tracking plug-in, exposing sensitive data of nearly 40,000 customers. The vulnerability was attributed to a configuration error in the company's scheduled data-cleanup process. The affected records included names, email addresses, shipping addresses, phone numbers, and purchase details, but not wallet credentials or financial information. SafePal has implemented measures to mitigate the risks, including retaining personal information for 90 days and purging affected records from active servers. The company has also engaged an independent security firm to validate the fix and review order-processing systems. Customers are advised to be cautious of unexpected contact or hardware delivery referencing their SafePal purchase.
In a disturbing revelation, SafePal, a prominent manufacturer of hardware wallets, has disclosed a significant flaw in one of its order-tracking plug-ins, which exposed the sensitive data of nearly 40,000 customers. This alarming incident serves as a stark reminder of the ever-present threat of data exposure in the digital age, where even the most seemingly secure systems can be compromised.
The vulnerability, which was first reported by SafePal in early May 2026, was attributed to a configuration error in the company's scheduled data-cleanup process. This error allowed unauthorized access to another customer's order information, which was subsequently exploited by an unknown actor. The affected records included names, email addresses, shipping addresses, phone numbers, and purchase details, but fortunately, wallet credentials or financial information were not compromised.
In a statement, SafePal emphasized that the incident did not involve the seed phrase, private keys, wallet password, or other wallet credentials, and that there was no evidence of compromised access to SafePal wallets or funds. However, the company acknowledged that the exposed records could potentially be used for fraudulent purposes, such as phishing, email, or text message scams.
To mitigate the risks associated with this incident, SafePal has implemented several measures, including the retention of personal information in the relevant order-processing environment to 90 days, subject to applicable legal requirements. The company has also purged the affected records from active servers, with a secured offline backup kept solely to support potential investigations. Furthermore, an independent third-party security firm has been engaged to validate the fix and review order-processing systems more broadly.
Additionally, SafePal has taken steps to contact its customers who may have been affected by the incident and to inform them of the measures being taken to address the issue. The company has also advised customers to treat any unexpected contact or hardware delivery referencing their SafePal purchase as suspect, regardless of whether it arrives by phone, in the post, or in person.
In the wake of this incident, it is clear that the importance of robust security measures and rigorous testing cannot be overstated. SafePal's vulnerability, which was attributed to a configuration error in the company's data-cleanup process, serves as a stark reminder of the need for organizations to prioritize security and to stay vigilant in the face of emerging threats.
The incident also highlights the importance of transparency and communication in the face of a security breach. SafePal's prompt disclosure of the issue and its subsequent efforts to address the problem demonstrate a commitment to accountability and customer safety.
As the world becomes increasingly reliant on digital systems, the need for robust security measures and vigilant monitoring of system vulnerabilities will only continue to grow. The SafePal incident serves as a timely reminder of the importance of prioritizing security and staying one step ahead of emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Depths-of-Vulnerability-A-SafePal-Hardware-Wallet-Makers-Descent-into-Data-Exposure-ehn.shtml
https://thehackernews.com/2026/08/safepal-hardware-wallet-maker-says-flaw.html
Published: Tue Aug 18 05:01:31 2026 by llama3.2 3B Q4_K_M
