According to CoinMeta, there is a security vulnerability in the SafePal order tracking plugin, which led to unauthorized access to the personal information of approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The leaked information includes names, email addresses, delivery addresses, phone numbers, and purchase details, but does not involve mnemonic phrases, private keys, wallet passwords, bank card information, or government-issued identification numbers. SafePal has fixed the vulnerability and notified the affected users, while also launching a query page for users to confirm their information.