SafePal

Summary

SafePal disclosed that roughly 40,000 individuals had their personal information compromised after attackers exploited a vulnerability in the order‑tracking function of a customer order information plugin. The exposed data included names, addresses, email addresses, phone numbers and order details, while wallet credentials, bank information and identification documents remained unaffected. The breach was made public at the same time a threat actor advertised the stolen data on a cybercrime forum. In response, the company patched the vulnerability, reduced data retention periods, notified affected users and removed fraudulent sites linked to the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hackers exploited a vulnerability in the order‑tracking function of a customer order information plugin to gain access to SafePal customer information. The compromised data included names, addresses, email addresses, phone numbers, and order details. Approximately 40,000 individuals were impacted by the breach. SafePal stated that no wallet credentials, bank details, or identification documents were affected. The breach resulted in the exposure of personal contact and order information for the affected users.

SafePal disclosed the breach on a Sunday, the same day a threat actor advertised the stolen data on a cybercrime forum. Upon discovery, the company addressed the vulnerability that had been exploited. SafePal also shortened its data retention practices to limit the amount of information stored. The firm notified all impacted individuals about the breach and the specific data that was accessed. In addition, SafePal took down fraudulent websites that had been linked to the breach.

Affected users were advised to avoid responding to suspicious requests for their seed phrases or private keys. SafePal emphasized that wallet credentials, bank details, and identification documents were not compromised. The company stated that it had addressed the vulnerability, shortened data retention, notified impacted individuals, and taken down fraudulent sites linked to the breach. No additional information about the attackers' identity or methods was disclosed in the source material. The breach disclosure and subsequent remediation were communicated to the public via the company's announcement and related coverage.

Sources

Sources available to members: 1 source.