SafePal users targeted by phishing letters after customer data breach - Crypto Briefing
Scammers are mailing Italian SafePal customers fake letters with QR codes that lead to phishing sites, using data exposed in an earlier breach.
Crypto phishing usually arrives in your inbox. For some SafePal customers in Italy, it showed up in the mailbox, printed on paper, with a QR code attached. Attackers are using customer data exposed in a SafePal breach to send fraudulent physical letters that look like official communications.
The hardware wallet maker disclosed the breach on August 16, 2026, affecting approximately 39,798 customers. The root cause was an authorization flaw in an order-tracking plugin that allowed unauthorized access to order records.
What leaked in the breach
The exposed information included names, email addresses, shipping addresses, phone numbers and purchase details. The affected orders were placed between March 2, 2025, and April 11, 2026. SafePal confirmed that seed phrases, private keys, wallet passwords and financial data were not compromised.
Physical letters as phishing tools
After the disclosure, SafePal noted a rise in targeted phishing campaigns using real order data to appear credible. By November 12, 2026, Italian users were receiving fraudulent letters containing accurate personal information, framed as notices about firmware security issues.
The company said it has taken down more than 30 fraudulent websites and links tied to the incident.
Company response and user risks
SafePal notified affected customers individually by email on August 16, 2026, and launched a status-check tool. The company has also engaged third-party auditors and limited data retention to 90 days as a preventive measure.
The leaked information enables convincing social-engineering attacks. The physical letters add an uncomfortable layer of risk, as many people treat paper mail as more trustworthy than digital communications. For affected customers, the risk isn't an immediate drained wallet but a steady stream of well-informed scam attempts that could persist for a long time.
The safest approach is to treat any unexpected message about firmware, security problems or refunds with suspicion, regardless of format. Legitimate wallet companies never ask for seed phrases through external channels. SafePal's 90-day retention policy represents a constructive step toward limiting future exposure.
Related
