Skip to content
SafePal Data Breach Leads to Phishing Letters Targeting Customers

SafePal Data Breach Leads to Phishing Letters Targeting Customers

First seen 12 Nov 2026, 21:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 21:45 UTC
  • •SafePal's data breach exposed personal information of nearly 40,000 customers.
  • •Scammers are using the leaked data to send convincing phishing letters to victims.
  • •SafePal confirmed that customer funds and wallet security remain intact despite the breach.

SafePal, a hardware wallet manufacturer, disclosed a data breach on August 16, 2026, affecting approximately 39,798 customers. The breach was caused by an authorization flaw in an order-tracking plugin, exposing names, email addresses, shipping addresses, phone numbers, and purchase details, but not sensitive financial data. Following the breach, scammers began sending fraudulent physical letters to affected Italian customers, containing QR codes that link to phishing sites masquerading as official SafePal communications. The letters falsely claim that the recipients' wallets have firmware flaws, prompting them to enter their recovery phrases on the fake sites. SafePal has confirmed the letters are scams and has taken down over 30 fraudulent websites. The company has implemented measures to notify affected customers and engage third-party auditors to enhance security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-08-16
SafePal discloses data breach
A flaw in an order-tracking plugin exposed data of 39,798 customers, including personal details but not financial data.
Cryptobriefing
2026-11-12
Scam letters reported
Scammers began mailing fraudulent letters to SafePal customers in Italy, using leaked data to appear credible.
Yahoo

More articles in this cluster (4)

Extracted Entities (8)

1 / 4

Common questions

What information was leaked in the SafePal breach?
The breach exposed names, email addresses, shipping addresses, phone numbers, and purchase details, but not financial data.
How can I identify the phishing letters?
Look for QR codes and claims about firmware flaws; SafePal will never send physical letters or ask for recovery phrases.
What should I do if I receive a phishing letter?
Do not engage with the letter; report it to SafePal and avoid entering any personal information on linked sites.