SafePal order-tracking plug-in authorization actively exploited security flaw
Vulnerability
Summary
Hide ▲
Show ▼
SafePal's order-tracking plug-in had an authorization flaw that was actively exploited to expose customer order information for about 39,798 customers. The weakness let an unauthorized user access another customer's order details and became the route used to steal order data. SafePal says it fixed the vulnerability and added additional security measures during the July 2026 review of its order-processing system. The affected information included order-related personal details that could support targeted phishing and other social-engineering attacks.
Related Happenings
SafePal hit by cyberattack
Incident
H score44
First: 17.08.2026 02:47
Last: 17.08.2026 02:47
Sources 1
How related:
However, as part of this investigation, SafePal determined that a threat actor exploited the flaw to steal order information belonging to approximately 39,798 customers.
About this happening:
The SafePal breach exposed customer order information after an authorization flaw in the order-processing system was exploited, putting about 39,798 customers at r...
SafePal hit by cyberattack
IncidentHow related: However, as part of this investigation, SafePal determined that a threat actor exploited the flaw to steal order information belonging to approximately 39,798 customers.
About this happening: The SafePal breach exposed customer order information after an authorization flaw in the order-processing system was exploited, putting about 39,798 customers at r...
SafePal customer order data breach and sale claim
Data Leak
H score39
First: 17.08.2026 02:47
Last: 17.08.2026 02:47
Sources 1
How related:
SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data.
About this happening:
SafePal disclosed a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and the stolen dataset is now being of...
SafePal customer order data breach and sale claim
Data LeakHow related: SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data.
About this happening: SafePal disclosed a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and the stolen dataset is now being of...
Timeline
-
17.08.2026 02:47 2 articles · 1h ago
SafePal warns of order-data breach and stolen-data sale
Initial DisclosureSafePal warned that an authorization flaw in the order-tracking function of a plug-in let a threat actor steal customer order information from about 39,798 customers, exposing names, email addresses, shipping addresses, phone numbers, and purchase information. The company said it first received a report consistent with the issue in early May 2026, escalated it into a formal security investigation, discovered the flaw during a July 2026 review, fixed the vulnerability, and notified impacted customers by email on August 16. SafePal also launched an online verification tool for affected orders and said a threat actor is now offering the stolen customer data for sale on a cybercrime forum.
Show sources
- SafePal data breach impacts 39,798 customers, stolen info for sale — www.bleepingcomputer.com — 17.08.2026 02:47
- SafePal data breach impacts 39,798 customers, stolen info for sale — www.bleepingcomputer.com — 17.08.2026 02:47