SafePal data breach: nearly 40,000 names and home addresses leaked

On August 16, 2026, SafePal said a flaw in its order-tracking plug-in let someone view another customer’s order records. The company says this covered orders placed between March 2, 2025 and April 11, 2026, and that approximately 39,798 customers were affected.

The visible fields were name, email address, shipping address, phone number, and purchase details. SafePal says seed phrases, private keys, wallet passwords, bank and card data, government IDs, wallets, and funds were not involved, and that it has no evidence this incident opened access to SafePal wallets or funds. Affected customers were emailed that same day. SafePal says the flaw is fixed, extra controls are in place, this kind of order data is now kept for 90 days, and more than 30 related phishing sites have been taken down.

They did not steal the wallet. They learned who bought one.

Most coverage leads with the reassuring half: no keys, no passwords, no cards, no money moved. That is what SafePal reported, and nothing public has contradicted it.

What those write-ups leave in the second paragraph is the part that actually follows you. If you bought from SafePal in that window, the useful thing an outsider now has is not a way into your wallet. It is a record that ties a real name to a real shipping address, a phone number, an email, and the fact that this household ordered crypto hardware or related gear. That is a targeting list, not a vault combination.

The honest read is narrower than a bank breach and more personal than a spilled email list. Nobody can spend your coins with this file. Someone can write you a message that already knows what you ordered and where it went, or treat a home address as a place that received a hardware wallet. That is the difference this story usually buries.

What to actually expect

• Emails, texts, or websites that mention a SafePal order, a tracking detail, or this claimed breach, then ask you to “verify,” “restore,” or “secure” a wallet. SafePal has already taken down more than 30 related phishing sites, which means this wave is already moving.
• Contact to the email or phone number that was on the order, using your name and what you bought so it sounds internal.
• If you were among those approximately 39,798 customers, a genuine SafePal email dated August 16, 2026. That notice is not a request for a seed phrase, a password, or a payment.
• Copycat pages that mimic SafePal’s order tracker or its scam-protection page at https://www.safepal.com/scam-protection. Type that address yourself if you need to check an order ID. Do not use a link that arrived with the scare.

What you can and cannot fix

If your order was in this set, the name, email, shipping address, phone number, and purchase details from that order are out. That copy cannot be pulled back. No company or takedown can un-leak it.

If you never placed a SafePal order between March 2, 2025 and April 11, 2026, this file is not about your records. If you did, the useful work is not “getting the data deleted.” It is making that bare record harder to turn into a full dossier, and refusing the scams that will try to finish the job.

• Do not hand over a seed phrase, private key, or wallet password. Those were not in this leak. Anyone who asks for them now is not helping you recover from it.
• Treat unexpected SafePal-looking messages as hostile until you have opened the official site yourself. The August 16 email does not need you to connect a wallet or pay a “verification” fee.
• Strip your name and address off people-search listings. A leaked order becomes much more dangerous when it is joined to public pages that add relatives, extra phone numbers, employers, and previous addresses. Those listings, unlike the breach file, can actually be removed. That is the lever that still works.
• Be picky about the phone and email that were on the order. Codes, “delivery” calls, and reset messages that arrive there may be someone using the leaked record, not SafePal.