Trezor Breach: 67,000 US Records Exposed via ShipMonk

Trezor, the hardware wallet manufacturer, disclosed on Friday that a data breach at its shipping provider ShipMonk exposed personal and order information belonging to 67,000 customers in the United States. The compromised records include customer names, email addresses, phone numbers, shipping addresses, and order numbers tied to purchases made between November 2019 and August 2021. Trezor emphasized that the breach does not affect the security of its hardware wallets, which store cryptocurrency private keys offline. The incident is a supply chain breach: attackers compromised a third-party logistics vendor and, through that vendor, reached order data that Trezor believed had been deleted.

The disclosure expands an earlier notice. Last month, Trezor reported that 13,689 customers had their data either fully or partially exposed. At that time, the company said the breach was limited to data within its 90-day storage policy. Now Trezor says ShipMonk informed it of unauthorized access to the shipping provider's systems on August 10, 2026. Following that notification, ShipMonk revealed that an additional 1,947 customers whose exposure had been limited only to names, cities, and email addresses, without shipping addresses, may include older orders. Trezor said it repeatedly requested and received written assurance from ShipMonk that the data had been deleted, in line with its contract, data policy, and past communications. The company expressed disappointment that, despite receiving this confirmation, the data was not deleted in the vendor's systems.

The breach has been linked to a zero-day vulnerability in Metabase, a data analytics and business intelligence tool. According to enterprise blockchain security firm Holborn, the attackers exploited CVE-2026-72898, a critical SQL injection flaw with a CVSS score of 10.0, the highest possible severity rating. A SQL injection attack works by inserting malicious code into a database query, allowing an attacker to view or change data they should not have access to. Holborn said the ShinyHunters extortion gang is believed to be behind the breach. The firm described the incident as a software supply chain attack that began with the zero-day vulnerability. By finding and exploiting the flaw in Metabase, the attackers were able to reach several of its customers, steal sensitive data, and extort the affected organizations. In Trezor's case, this meant the exposure of customer order details that were stored in a Metabase instance run by ShipMonk. ShipMonk has not yet publicly acknowledged the incident. The logistics company is said to have secured the affected systems and improved its security after the digital break-in.

For the affected Trezor customers, the main risk is not theft of cryptocurrency from the hardware wallets themselves, but social engineering and scams built on the leaked order details. Trezor said it has notified affected customers directly and warned them to be on the lookout for phishing emails, fraudulent letters, and fake phone calls. Attackers can use the exposed names, email addresses, phone numbers, shipping addresses, and order numbers to make their messages look convincing. They may impersonate Trezor in email communications and try to persuade targets into taking actions such as revealing a wallet recovery phrase or moving funds. Trezor warned that the leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks. Because the data includes physical shipping addresses, customers should also be alert to possible attempts to use that information in person or by mail.

Holborn said the attack highlights the need for organizations to have complete visibility into their third-party risk exposure in order to manage their overall security posture. This is a reminder for any business that shares customer data with vendors: a written deletion promise is not always enough, and ongoing verification matters. For website owners, online stores, and IT teams that handle customer orders through logistics or analytics partners, the Trezor incident shows how a flaw in a widely used third-party tool can become a route into customer records. A security-first infrastructure and consulting partner such as AEU-I can help organizations map and manage that kind of outside risk exposure with a focus on vendor security and data handling.