Was I in the SafePal data breach? What was leaked in August 2026

On 16 August 2026, SafePal said it had found a flaw in the order-tracking tool tied to customer purchases. In some cases, that flaw let someone see another customer's order, not just their own. SafePal says order records for people who bought between 2 March 2025 and 11 April 2026 were viewed from outside the company without permission. About 39,798 customers are involved.

Those records included name, email address, shipping address, phone number, and what was purchased. SafePal says the incident did not include seed phrases, private keys, wallet passwords, bank or payment-card data, or government IDs. It says it fixed the flaw, emailed affected customers on 16 August, cut how long it keeps this kind of data to 90 days, and took down more than 30 related phishing sites. It says there is no evidence that wallets or funds were taken through this incident.

The keys were not taken. Your name and address were.

Most coverage will lead with the line that no private keys were allegedly stolen. That is true. It is also the least useful part of the story if you actually ordered a device.

What an unauthorized party may now have is not a way into the wallet. It is a list that ties a real name to a home address, a phone number, an email, and the fact that a hardware wallet was shipped there. People buy these devices because they hold crypto they do not want sitting on an exchange. Attached to a front door and a phone number, that fact is a targeting list. The headlines that sound like reassurance are describing the same records a scammer would most want.

The honest read is not that this hole emptied anyone's wallet — SafePal says it did not, and the leaked fields cannot do that on their own. The honest read is that tens of thousands of households have been marked, by name and address, as hardware-wallet owners. Anything that follows will look like a call, a text, or an email that already knows too much about you.

What to actually expect

• If SafePal believes you are among the 39,798, it says it emailed you on 16 August 2026. Check spam and promotions. No email is not proof you were left out. The better test is whether you placed an order between 2 March 2025 and 11 April 2026.
• Emails, texts and lookalike websites using your real name or order details, asking you to “verify,” “migrate,” or “secure” a wallet. SafePal says it has already taken down more than 30 related phishing sites. New ones will keep appearing.
• Calls or messages to the phone number that was on the order, from people who already know a device was bought.
• A longer run of targeted scams over the coming months that treat you as a known hardware-wallet owner at a known address.

What you can and cannot fix

The copy of those order records that left SafePal cannot be pulled back. If your name, shipping address, email, phone number and purchase details were in the affected set, they are out. That does not change, and no service can recall it.

• Never give anyone the recovery words, private key, or wallet password because they contacted you about this. SafePal does not need them to “fix” anything. That is the main attack this leak sets up.
• Ignore unexpected SafePal links. If you need to check something, type the company's site yourself. Do not use a link from an email or a text.
• Put a new, unique password on the email account you used for the order, and turn on two-step login. That inbox is now a known way to reach someone who bought a wallet.
• Remove yourself from people-search and data-broker listings that publish your address, relatives, extra phone numbers and past addresses. A bare leaked order file becomes much more useful when it can be joined to those listings — and unlike the breach data, those listings can actually be taken down.