Trezor Discloses ShipMonk Breach Exposed Data of 67,000 U.S. Customers

Customer Data Exposed in ShipMonk Breach

Trezor, a hardware wallet manufacturer, revealed that 67,000 U.S. customers were impacted by a data breach at its shipping partner, ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers for orders placed between November 2019 and August 2021. This incident does not compromise the security of Trezor's hardware wallets themselves.

Failure to Delete Data Despite Assurances

Trezor stated that it had repeatedly requested and received written confirmation from ShipMonk regarding the deletion of customer data, in accordance with their contract and data policy. Despite these assurances, the data was not deleted from ShipMonk's systems, leading to its exposure. This breach adds to a previous disclosure of 13,689 customers whose data was partially or fully exposed.

Breach Details and Attacker Attribution

ShipMonk informed Trezor of the breach on August 10, 2026, following unauthorized access to its systems. The logistics company has reportedly secured the affected systems and improved its security. The breach involved the zero-day exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase. Enterprise blockchain security firm Holborn attributes the breach to the ShinyHunters extortion gang.

Customer Notification and Security Warnings

Trezor has directly notified affected customers. The company also issued a warning for users to be vigilant against social engineering attacks and scams. Bad actors could use the leaked information to send phishing emails, make fraudulent calls, or impersonate Trezor in communications to trick targets into unintended actions.