According to Italian crypto media outlet Criptovaluta, a previous data breach at hardware wallet manufacturer SafePal has led to physical mail phishing attacks targeting Italian users. The fraudulent letters impersonate SafePal, claiming that the recipients' wallets have firmware vulnerabilities, and contain QR codes pointing to a fake SafePal website via Arweave. Both the letters and the phishing website feature accurate customer names, addresses, and order details. Previously, a SafePal order tracking plugin malfunctioned between March 2025 and April 2026, leading to a personal data leak affecting nearly 40,000 customers.