SafePal disclosed on August 16, 2026, that an authorization flaw in an order-tracking plugin exposed information linked to 39,798 customers whose orders were placed between March 2, 2025, and April 11, 2026. Names, email addresses, shipping addresses, phone numbers and purchase details were exposed, but recovery phrases, private keys, card numbers and customer funds were not compromised. Attackers later used the leaked data in targeted phishing campaigns, including letters mailed to some Italian customers that falsely claimed a firmware security issue affected their hardware wallets. The letters used real customer information and QR codes leading to fake SafePal websites hosted on Arweave. SafePal confirmed the letters were fraudulent by November 12, said its wallet infrastructure remained secure, and warned that it would never send physical letters or request seed phrases. The company had notified affected customers, removed more than 30 related websites and links, launched an order-status checker, engaged third-party auditors and reduced data retention to 90 days. Similar address-based targeting has affected Ledger customers, while a Trezor shipping partner disclosed 13,689 customer records in August.