Full Report
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. [...]
Analysis Summary
# Incident Report: SafePal E-commerce Authorization Bypass
## Executive Summary
SafePal, a cryptocurrency hardware wallet provider, suffered a data breach impacting 39,798 customers who placed orders between March 2025 and April 2026. An authorization flaw in an order-tracking plug-in allowed a threat actor to exfiltrate PII, including names, addresses, and phone numbers. While wallet funds remain secure, the stolen data is being sold on cybercrime forums and used in targeted phishing campaigns.
## Incident Details
- **Discovery Date:** Initial reports May 2026; formal confirmation July 2026
- **Incident Date:** March 2, 2025 – April 11, 2026
- **Affected Organization:** SafePal
- **Sector:** Cryptocurrency / Hardware Manufacturing
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Approximately March 2025
- **Vector:** Exploitation of a software vulnerability
- **Details:** A flaw in the authorization logic of an order-tracking plug-in within the e-commerce platform.
### Lateral Movement
- **Details:** Not applicable in a traditional network sense; the attacker exploited the plug-in to iterate through and access order records belonging to other customers (IDOR-style vulnerability).
### Data Exfiltration/Impact
- **Details:** Personal Identifiable Information (PII) for 39,798 customers was exfiltrated. A threat actor later surfaced on a cybercrime forum offering the database for sale.
### Detection & Response
- **May 2026:** First report received; SafePal initially treats it as an isolated incident.
- **July 2026:** Full system review and rebuild initiated; authorization flaw discovered and patched.
- **August 16, 2026:** SafePal issues a public security advisory and notifies affected customers via email.
## Attack Methodology
- **Initial Access:** Exploitation of a Broken Object Level Authorization (BOLA) or similar authorization flaw in an e-commerce plug-in.
- **Exfiltration:** Systematic scraping of order information via the tracking function.
- **Impact:** Use of stolen data for social engineering (phishing emails and fraudulent phone calls) and data brokering on the dark web.
## Impact Assessment
- **Financial:** No direct loss of customer funds reported; potential costs related to incident response and third-party audits.
- **Data Breach:** Exposure of names, email addresses, shipping addresses, phone numbers, and purchase history for ~40k users.
- **Operational:** Required a "full review and rebuild" of the order-processing system.
- **Reputational:** Public disclosure of the breach and the sale of data on forums; customers targeted with high-conviction phishing.
## Indicators of Compromise
- **Network indicators:**
- Fraudulent domains: Over 30 phishing sites (e.g., `safepal[.]com[.]scam-protection[.]xyz` - *example of defanged structure*).
- **Behavioral indicators:**
- Phishing emails with subject lines regarding mandatory "firmware updates" for the SafePal X1.
- Unsolicited phone calls from individuals impersonating SafePal employees.
## Response Actions
- **Containment:** Patched the authorization flaw in the tracking plug-in.
- **Eradication:** Purged PII from active e-commerce servers; took down 30+ phishing sites.
- **Recovery:** Launched an online verification tool for customers; engaged a third-party security firm for a broader audit.
## Lessons Learned
- **Siloed Incident Reporting:** Early warnings in May were treated as isolated cases rather than indicators of a systemic breach, delaying the full investigation by two months.
- **Data Retention Failures:** A configuration error caused a data-cleanup process to fail, resulting in the retention of older data that should have been purged, thereby increasing the breach scope.
- **Third-Party Risk:** The vulnerability originated in a plug-in, highlighting the need for rigorous security reviews of integrated third-party components.
## Recommendations
- **Implement Robust Authorization:** Ensure all API endpoints and tracking tools require strict authorization checks to prevent users from accessing data belonging to others.
- **Automate Data Lifecycle Management:** Implement monitoring and alerting for data-cleanup scripts to ensure PII is purged according to policy.
- **Enhanced Phishing Education:** Warn customers that hardware wallet providers will never ask for seed phrases or private keys via phone or email.
- **Proactive Threat Hunting:** Regularly monitor cybercrime forums for mentions of brand-specific data to identify breaches before they are reported by users.