SafePal says a flaw in its order-tracking plugin exposed customer order information for about 39,798 people, and the data is now being advertised for sale on a cybercrime forum. The exposed records cover orders placed between March 2, 2025 and April 11, 2026.
The bug let one customer view another customer’s order details, so the attacker did not need wallet passwords or seed phrases to get names, addresses, phone numbers, email addresses, and purchase records. That makes the data useful for phishing and impersonation, especially when a scammer can cite a real order or shipping address to sound legitimate.
For SafePal customers and any business that uses order history as a contact trail, the risk now sits in the customer record itself. If those details are already circulating for resale, the exposure can outlive the fix and keep feeding refund lures, fake support calls, and other targeted scams.