On August 16, SafePal revealed that due to an authorisation vulnerability in the order tracking plugin, the order data of around 39,798 customers was at risk of being leaked. This data pertained to customers who had made their orders from March 2, 2025, through April 11, 2026, and included names, email addresses, shipping addresses, phone numbers, and purchase details. According to SafePal, it has been sending individual email notifications to affected customers over the weekend and has created a mechanism through which users can verify purchases using their order number and shipping country.
Company Strengthens Order Systems After Discovering Access Control Flaw
SafePal also stated in its post on X that there was no indication that the event affected wallet access or customer funds. According to the wallet provider, the seed phrase, private key, wallet password, credit or debit card number, bank account details, and government-issued ID numbers were not compromised. SafePal further added that the problem was related to an unauthorised bug in a plugin that helped gain access to the orders. In certain situations, the vulnerability could allow access to someone else’s order information. However, the company confirmed that they have fixed the vulnerability and introduced additional access controls after identifying it.Â
The company’s incident FAQ report gives a more detailed timeline of events. According to SafePal, in early May, they got a phishing report matching the issue they were experiencing. The company did not consider it a security issue at first, but later on, it was escalated to a security investigation. In July, they conducted a comprehensive review, rebuilt their ordering pipeline, and confirmed the flaw during that investigation.Â
In a separate disclosure, SafePal reported that a data clean-up procedure scheduled between September 2025 and April 2026 had failed due to a configuration problem. The failure was not related to the incident but helped extend the period of impacted orders, which goes back to March 2025. Now, SafePal has shortened the personal data collection period in the order processing system to 90 days. SafePal said that the personal information of the affected customers has been removed from active e-commerce servers, and an encrypted copy will be stored offline for investigation purposes.
Post the breach, the company added that it is working with a third-party security firm to test and confirm its fix and also perform a more comprehensive review of the order management system. The firm has not been publicly disclosed yet. SafePal has also reached out to its logistics and fulfillment partners to find out if the hack has spread to them as well.
