45
45
45
45
45
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
Hardware wallet maker SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers and purchase details of approximately 39,798 customers. No seed phrases, private keys, wallet credentials or financial information were exposed, and SafePal found no evidence of wallet or fund compromise. A separate configuration error left a data-cleanup process broken between September 2025 and April 2026, extending the affected order window back to March 2025. A threat actor has advertised a matching dataset on a cybercrime forum, and the company has fixed the flaw, cut data retention to 90 days, purged affected records, engaged third-party validators and taken down over 30 phishing sites.
48
45
45
45
Cybercrooks trawl Fishbrain to net password hashes
Fishing app Fishbrain disclosed a breach exposing names, emails, and password hashes with salts for users of its 20-million-member platform.
Fishbrain AB disclosed to the California Attorney General's Office that attackers accessed user data on August 19, 2026, taking names, dates of birth, email addresses, phone numbers, usernames, country information, password hashes, and salts. The company said passwords were not stored in plaintext but some hashes may be susceptible to cracking; it patched the exploited vulnerability, reset all user passwords, and restricted access to the affected environment. Fishbrain, which claims more than 20 million users, did not disclose how many accounts were affected or which hashing algorithm was used.
48
45
45
45