SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
- ID
- 15075
- Status
- summarized
- Published
- 18 Aug 2026, 5:10 PM
- Fetched
- 18 Aug 2026, 5:34 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/safepal-hardware-wallet-maker-says-flaw.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 18 Aug 2026, 5:34 PM
- Tags
- Audience
- developerssaas_founders
What happened
SafePal disclosed that an authorization flaw in an unnamed order-tracking plug-in exposed the names, emails, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026. No wallet credentials, private keys, or financial information were exposed, and SafePal has not named the plug-in, its vendor, the affected version, or assigned a CVE.
Why it matters
For builders shipping e-commerce or order-tracking integrations, this is a concrete reminder that third-party plug-ins with authorization flaws can leak customer PII at scale; review the authorization boundaries of any order-tracking or fulfillment plug-in you depend on, since SafePal has not disclosed which plug-in was responsible.
Discussion angle
The vendor still hasn't named the plug-in or assigned a CVE over two days after notification—discuss how opaque third-party vulnerability disclosure undermines the ability of other builders to assess their own exposure.