Removed: nothing, from September 2025. The cleanup job that deleted old order records had stopped running and was still not running in April 2026, so the order system held addresses and purchase histories back to March 2025.
Outcome: 39,798 customers’ order records were exposed — name, email, shipping address, phone number, purchase details — and retention in that environment is now 90 days.
The way in was an authorization flaw in an order-tracking plug-in: “Under certain conditions, the flaw allowed unauthorized access to another customer’s order information.” What the breach could not reach was decided earlier. SafePal says it “never requests, collects, processes or stores” seed phrases, private keys, wallet passwords, bank details, card numbers or government IDs, and keeps cold storage “entirely separated from e-commerce servers”. Phishing risk, no key material.
The awkward part is the timeline. A first report reached the company in early May 2026, and SafePal says it “treated it as an isolated case at the time” before escalating. Of the broken cleanup: “That issue did not cause the unauthorized access itself, but it is why the affected range extends back to March 2025.” A dataset citing the same order window was advertised on a cybercrime forum the day the disclosure went out.
Sources: