Hardware wallet maker SafePal disclosed a data breach impacting 39,798 customers after an order-tracking plugin flaw exposed names, addresses, and phone numbers over 14 months.