SafePal disclosed that nearly 40,000 customers had personal and order information exposed due to an authorization flaw in an order-tracking plug-in. While wallet secrets were not exposed, SafePal warned that criminals can use the leaked order details to run highly convincing scams (fake support, refunds, firmware updates) designed to trick customers into handing over seed phrases or visiting malicious websites.
SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed personal and order information for roughly 39,798 customers. The exposed data included names, email addresses, shipping addresses, phone numbers, and purchase details. Wallet secrets such as seed phrases and private keys were not part of the exposure, but the leaked order details give attackers exactly what they need to make follow-on scams feel legitimate.
Order and shipping details are not sensitive in isolation, but they are powerful social engineering fuel. A message that correctly references a customer's recent SafePal order, its shipping address, or purchase date builds instant credibility, even when the message itself is fraudulent. SafePal warned that attackers could use this compromised information to create convincing phone calls, emails, text messages, letters, refund offers, firmware-update requests, malicious websites, and fake customer-support communications. This is why breaches involving order metadata, not just credentials, still carry real phishing risk.
Based on the exposed data, expect scams built around a few recurring themes:
Across all three, the common thread is a request, direct or implied, to hand over wallet recovery material or visit an unofficial site.
SafePal reported it has taken down more than 30 fraudulent websites and phishing links tied to this scam activity, but customers remain the last line of defense against messages that use their own order history against them.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers, and purchase details for nearly 40,000 customers. Wallet secrets like seed phrases were not exposed.
SafePal warned attackers could use the exposed order details to craft convincing phone calls, emails, texts, letters, refund offers, firmware-update requests, and fake customer-support outreach.
No. SafePal stressed that it will never request a seed phrase, private key, or wallet password by phone, email, or any other communication channel.
Anyone who entered a seed phrase or private key into a suspicious website or shared it with someone claiming to represent SafePal should consider that wallet compromised.
If you ever bought a SafePal wallet, your order details might be in a scammer’s playbook right now. Picture this email: “SafePal Support: Refund Offer.” It lists your exact device, your shipping address, even your phone number, and tells you to click a link to process a refund and enter your seed phrase to verify. Or a text: “SafePal: Firmware update required for your device order.” You tap the link, land on a fake SafePal page, and it calmly asks for your seed phrase or private key to complete the update. Here’s the rule: if any message about a SafePal purchase asks for your seed phrase, private key, or wallet password, stop, do not enter it, and go directly to SafePal’s official app or website instead.
SafePal disclosed a breach that exposed order and contact details for nearly 40,000 customers, and warned the stolen data may be used to run targeted phishing and impersonation scams. The company cautioned customers to expect fake support messages, refund offers, and firmware-update requests…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
The article describes real-world ways attackers get around multifactor authentication (MFA), including “push bombing” (MFA fatigue), phishing pages that relay codes in real time, SIM swapping, and stealing session cookies so MFA isn’t needed again. It also cites known incidents (e.g., Uber 2022 MFA…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
