SafePal data breach exposes details of nearly 40,000 users

cryptonews

Aug 16

SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. Summary Nearly forty thousand ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers HK | Online Trading in stocks, bonds & ETFS","description":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","keywords":"tiger trading,tiger security,tiger broker hk,tigers co ltd,tiger trade hk,tiger brokers hk,stock broker,securities broker,online brokerage,hong kong broker,hk broker,online stock trading,online trading platform,stock trading platforms,trading application,stock trading,stock trading hong kong,buying stocks in hong kong,tiger brokers","social":{"ogDescription":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://www.gotigerhk.com/news/2660177472"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"HKG","license":"TBHK","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2660177472\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2660177472?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-16 23:24","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2660177472","market":"hk","top_or_hot":-1,"title":"SafePal data breach exposes details of nearly 40,000 users","media":"cryptonews","content":"<div>\n<p>SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. \n\n\nSummary\n\n\n\nNearly forty thousand ...</p>\n\n<a href=\"https://crypto.news/safepal-data-breach-exposes-details-of-40000-users/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>SafePal data breach exposes details of nearly 40,000 users</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nSafePal data breach exposes details of nearly 40,000 users\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-16 23:24 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/safepal-data-breach-exposes-details-of-40000-users/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. \n\n\nSummary\n\n\n\nNearly forty thousand ...</p>\n\n<a href=\"https://crypto.news/safepal-data-breach-exposes-details-of-40000-users/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"WFH","symbol_name":"Direxion Work From Home ETF","start_time":0,"source_url":"https://crypto.news/safepal-data-breach-exposes-details-of-40000-users/","article_id":"2660177472","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/safepal-data-breach-exposes-details-of-40000-users/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2660177472","pubTimestamp":1786893854,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people.Nearly forty thousand SafePal customers had order information exposed through an authorization flaw in software.Exposed records included names, emails, shipping addresses, phone numbers and detailed SafePal purchase information externally.Seed phrases, private keys, wallet passwords, payment details and government identification numbers were not exposed.SafePal received a phishing report in May before confirming the authorization flaw during July investigations.The affected records covered orders placed between March 2, 2025, and April 11, 2026, and included names, email addresses, shipping addresses, phone numbers and purchase details. SafePal said it emailed affected customers individually on Sunday and launched a tool allowing buyers to check orders using their order number and shipping country.The wallet provider said seed p","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"WFH":"Direxion Work From Home ETF","UCYB":"ProShares Ultra Nasdaq Cybersecurity ETF","CRWC":"Corgi CRWD 2x Daily ETF","PSWD":"XTRACKERS CYBERSECURITY SELECT EQUITY ETF","CRWL":"2倍做多CRWD ETF-GraniteShares","HAKY":"Amplify HACK Cybersecurity Covered Call ETF","WCBR":"WisdomTree Cybersecurity Fund","SPAM":"THEMES CYBERSECURITY ETF"},"translate_title":"SafePal数据泄露暴露近40,000名用户的详细信息","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"CRWL":1.5,"WCBR":1.5,"PSWD":1.5,"SPAM":1.5,"HAKY":1.5,"WFH":1.5,"UCYB":1.5,"CRWC":0.6},"content_text":"SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. \n\n\nSummary\n\n\n\nNearly forty thousand SafePal customers had order information exposed through an authorization flaw in software.\nExposed records included names, emails, shipping addresses, phone numbers and detailed SafePal purchase information externally.\nSeed phrases, private keys, wallet passwords, payment details and government identification numbers were not exposed.\nSafePal removed over 30 phishing websites and shortened personal data retention to 90 days afterward.\nSafePal received a phishing report in May before confirming the authorization flaw during July investigations.\n\n\n\nThe affected records covered orders placed between March 2, 2025, and April 11, 2026, and included names, email addresses, shipping addresses, phone numbers and purchase details. SafePal said it emailed affected customers individually on Sunday and launched a tool allowing buyers to check orders using their order number and shipping country.\nThe wallet provider said seed phrases, private keys, wallet passwords, payment card numbers, bank account information and government-issued identification numbers were not exposed. SafePal also said it found no evidence that the incident itself compromised wallet access or customer funds.\nSafePal traced the exposure to an order-tracking flaw\nSafePal said the issue involved an authorization defect in a plugin used to track orders. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information. The company said it fixed the vulnerability and introduced additional access controls after identifying it.\n\nDear community,While your SafePal wallet, seed phrase, and private keys are secure; we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers.The issue has been fixed with additional security measures…— SafePal – Crypto Wallet (@SafePal) August 16, 2026\n\nThe company’s incident FAQ provides a longer timeline. SafePal said it first received a phishing report consistent with the problem in early May. It initially treated the report as an isolated case before escalating it into a formal security investigation. In July, the company began a full review and rebuild of its order-processing pipeline and confirmed the plugin flaw during that investigation.\nData-retention failure widened the affected period\nSafePal separately disclosed that a scheduled data-cleanup process stopped working correctly between September 2025 and April 2026 because of a configuration error. According to the company, that failure did not cause the unauthorized access but left older order records stored longer than intended, helping extend the affected range back to March 2025.\nSafePal has now reduced personal-data retention in the relevant order-processing environment to 90 days, subject to legal requirements. It said affected customers’ personal information has been removed from active e-commerce servers, while an encrypted offline copy is being retained to support potential investigations.\nPhishing is now the main risk for customers\nThe exposed information could help attackers create more convincing phishing attempts using genuine names, addresses and purchase details. SafePal said it has already identified and taken down more than 30 fraudulent websites and phishing links tied to scam activity and continues monitoring for new domains.\nThe risk resembles other recent wallet-industry incidents. As crypto.news reported, a third-party shipping breach exposed personal information belonging to 13,689 Trezor customers, including names, emails, phone numbers and shipping addresses. In related coverage, scammers have also mailed fake Trezor and Ledger letters containing QR codes designed to steal recovery phrases.\nSafePal stressed that it never asks customers for seed phrases, private keys or passwords. It said users do not need to move assets solely because their order information was exposed. However, anyone who has already entered a seed phrase or private key into a suspicious website should “treat that wallet as compromised,” create a new wallet and transfer remaining assets.\nWhat happens next\nSafePal said it is engaging an independent third-party security firm to validate its fix and conduct a broader review of its order-processing systems. The firm has not yet been named publicly. SafePal also contacted logistics and fulfillment partners and said it has found no evidence so far that the incident extended into their systems.\nThe company has opened a dedicated support channel and says it is contacting on-chain asset-tracing specialists for customers reporting financial losses. SafePal cautioned that this “does not represent any admission of liability or commitment to compensation.” It has not identified the unauthorized party or disclosed a confirmed amount lost through follow-on phishing. Further findings are expected through its official security updates.\n\n\n\n\n\n                Read more:\n            \n\n                Israel crypto broker Bits of Gold probes customer data breach","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}