On Friday, Trezor, the hardware wallet maker, announced the exposure of data for 67,000 U.S. customers following a breach at its shipping partner, ShipMonk. This incident, affecting customers between November 2019 and August 2021, involved leaked names, email addresses, phone numbers, shipping details, and order numbers. Fortunately, Trezor clarified that the security of its hardware wallets remains intact.
Details of the Breach
Trezor emphasized its dissatisfaction with ShipMonk, stating that they had repeatedly secured written confirmations regarding the deletion of customer data in compliance with their contractual and data policies. Despite these assurances, the data was not removed from ShipMonk’s systems. This revelation follows a previous disclosure affecting 13,689 customers, where data exposure was said to be limited by a 90-day data retention policy.
ShipMonk notified Trezor of the breach on August 10, 2026, attributing it to unauthorized access. Among the affected were 1,947 customers whose data exposure was confined to names, cities, and email addresses, excluding shipping addresses. Trezor reiterated its policy of deleting or anonymizing customer data 90 days post-purchase, a period covering the lifecycle of an order.
Security Measures and Responses
ShipMonk has not yet publicly addressed the breach. However, reports suggest that the company has fortified its systems in response to the security lapse. The breach exploited a zero-day vulnerability, identified as CVE-2026-72898, a severe SQL injection flaw in Metabase, which carries a CVSS score of 10.0.
The ShinyHunters extortion group is believed to be behind this intrusion, according to Holborn, a security firm specializing in blockchain. In response, Trezor has informed affected customers and cautioned them against potential social engineering tactics aimed at exploiting the leaked data.
Implications and Future Outlook
Trezor warns that the exposed information could lead to phishing attacks, fraudulent communications, and personal security risks. Users should remain vigilant against emails, calls, or letters that might attempt to impersonate the company to deceitfully extract further information.
Holborn highlighted the breach as an example of the vulnerabilities within software supply chains, urging organizations to enhance their oversight of third-party risks. The breach underscores the critical need for comprehensive visibility and management of security postures to prevent similar incidents.
As companies continue to rely on third-party service providers, the Trezor breach serves as a stark reminder of the importance of robust security frameworks and the constant evaluation of third-party vulnerabilities.
