Online Gaming Insider Incident and Crypto Wallet Data breach
Former Employee Copies and Deletes Online Game Provider’s Database
Turkey’s Personal Data Protection Authority, KVKK, reported a data breach involving the Red Galaxy Game website. The incident occurred on August 2–3, 2026, and was detected on August 3. According to the notification, the breach was caused by a former team member who had previously been granted limited access to the company’s systems.
The former team member exceeded the scope of the permissions granted and gained access to server-side software repositories. They then copied the database, used it for commercial purposes, and subsequently deleted it.
The incident affected the personal data of 7,507 individuals, including employees, users, subscribers, customers, and potential customers.
The incident is notable for the volume and variety of data affected. The personal data involved in the breach includes:
- Email addresses
- Usernames
- Password hashes and password reset codes
- IP addresses
- Device and operating system information
- Private messages between users and the in-game general chat
- Google Play purchase records
- Xsolla payment records
- Internal correspondence and transaction records
- Inventory, progress, and in game transaction records
The investigation into the incident is ongoing.
SafePal Data Breach Exposes 40,000 Crypto Wallet Users
Hardware crypto wallet provider SafePal confirmed a data breach affecting nearly 40,000 customers. The incident involved users who placed orders between March 2, 2025, and April 11, 2026.
The exposed information includes:
- Names
- Contact information, including email addresses and phone numbers
- Purchase details
- Shipping addresses
SafePal linked the incident to a vulnerability in a plugin’s order-tracking feature that processed customer information. Under certain conditions, the flaw allowed unauthorized access to other customers’ order data. SafePal said the issue has since been fixed. The company also stressed that hardware wallets themselves, seed phrases, and users’ private keys were not affected.
SafePal warned customers that the exposed information could be used in sophisticated phishing campaigns involving phone calls, emails, SMS messages, refund offers, and fraudulent messages impersonating customer support.
For cryptocurrency holders, the consequences of exposing personal information can be particularly serious. A combination of a person’s name, contact details, physical address, and evidence of a hardware wallet purchase can directly identify them as a holder of digital assets.
The Record notes that such breaches may increase the risk not only of online fraud, but also of industry-specific wrench attacks, in which cryptocurrency holders are physically coerced into handing over access to their assets.
Effective data protection requires addressing both external attacks and insider threats.To minimize insider-related risks, organizations need full visibility into user activity and the ability to detect risky behaviour before it leads to data loss or other business damage. SearchInform Risk Monitor is a unified platform for insider threat mitigation, combining user activity monitoring and data protection to help organizations detect potential violations before they turn into incidents.
Try SearchInform Risk Monitor for free and strengthen insider threat protection across your organization.
