SafePal users targeted by phishing letters after customer data breach

SafePal sells crypto hardware wallets, which are designed to keep private keys away from online systems. A breach that exposed customer details has now been followed by fake letters sent to Italian customers’ homes. That combination makes the attack more convincing because it uses real names, addresses and order information tied to SafePal ownership.

SafePal users now have to treat physical mail with the same caution they would apply to email or direct messages. Letters that appear to come from a hardware-wallet company can be used to steer owners toward disclosure or other unsafe actions, even when the wallet itself is not compromised. SafePal’s statement that its wallets remain secure means the immediate risk sits with customer identity and communication channels, not the device hardware. (per cryptobriefing.com)

The episode shows a gap between securing a product and securing the customer data around it. Hardware wallets are meant to reduce digital exposure, but leaked shipping and order records can still be turned into social-engineering tools. That leaves companies that sell self-custody products responsible not only for device security but also for protecting the personal information attached to those sales.

What remains unclear is how the breach was carried out and whether more customers outside Italy were affected in the same way. It is also not settled how broadly the leaked data has spread beyond the letters now reaching homes. SafePal’s response and any further disclosure would show how much of the customer base is still at risk.

SafePal rose 0.5% in the 4 hours after the first headline, after rising 0.4% in the 2 hours before.

27 prices, one every 30 minutes