SafePal hardware wallet customers in Italy have been targeted by a novel phishing campaign delivered through physical mail. Attackers are sending fraudulent letters containing QR codes that direct recipients to phishing sites, using personal information exposed in an earlier data breach.
SafePal disclosed the breach on August 16, 2026, affecting approximately 39,798 customers. The root cause was an authorization flaw in an order-tracking plugin that allowed unauthorized access to customer order records. The exposed data included names, email addresses, shipping addresses, phone numbers, and purchase details for orders placed between March 2, 2025, and April 11, 2026.
The company confirmed that seed phrases, private keys, wallet passwords, and financial data were not compromised. Customer funds held in the wallets remained untouched.
Phishing Campaign Takes Physical Form
Following the disclosure, SafePal observed a rise in targeted phishing campaigns beginning by November 2026. By November 12, the company confirmed that Italian users were receiving fraudulent letters framed as notifications about firmware security issues, each containing a QR code linking to phishing sites. SafePal has confirmed these letters are scams and reported taking down more than 30 fraudulent websites and links tied to the incident.
The attacks have also included emails and phone calls, all leveraging the exposed customer data to appear credible.
Company Response and Mitigation
SafePal notified affected customers individually by email on August 16, 2026, the day of the disclosure. The company launched a status-check tool allowing customers to enter their order ID and shipping country to determine if their data was exposed.
SafePal has engaged third-party auditors and implemented a 90-day data retention limit as a preventive measure to reduce future breach risks.
Risks for Hardware Wallet Users
While the hardware wallets themselves were not compromised, the exposed personal information enables convincing social-engineering attacks. Scammers can use legitimate-sounding messages about firmware updates, security issues, or refunds to trick users into disclosing seed phrases or installing malicious software.
The use of physical mail introduces additional risk, as many recipients may regard printed letters as more trustworthy than digital communications. Customers should treat any unsolicited messages about firmware, security problems, or refunds with suspicion regardless of format. Legitimate wallet companies do not request seed phrases through external communications.
