Trezor has disclosed an expanded data breach originating from its shipping provider, ShipMonk, affecting an additional 67,000 customers. This brings the total number of affected individuals to approximately 80,700. The exposed personal information includes names, email addresses, phone numbers, home addresses, and order numbers, raising significant concerns about customer privacy and physical security.
Trezor stated that its own systems were not compromised, and private keys and wallet backups remain secure. The breach at ShipMonk is attributed to a SQL injection flaw in the analytics tool Metabase, which allowed unauthorized access to connected databases. This vulnerability was disclosed on August 6.
The newly disclosed group of affected customers primarily consists of individuals in the U.S. who placed orders between November 2019 and August 2021. The exposure of home addresses is a particular point of concern, as it moves the risk beyond digital privacy to potential physical security threats. Trezor warned that “A letter carrying a name and home address signals ‘we can locate you.’”
This incident significantly expands upon a previous disclosure in August, where Trezor reported a breach affecting 13,689 customers. Trezor had previously cited a 90-day deletion policy negotiated with its fulfillment partners as a reason for the limited scope of the initial breach. However, Trezor repeatedly asked for and received written confirmation that records had been deleted, in line with its contract and data policy, and expressed disappointment to learn they had not been.
Some of the exposed records are nearly seven years old, dating back to November 2019. This longevity of data increases its potential utility for malicious actors, as “stolen data stays useful for years because people rarely move or change their numbers.”
In addition to the Trezor and ShipMonk entities, the same breach wave also affected Framework and Tally. ShipMonk has reportedly received extortion emails attributed to the group ShinyHunters, though this attribution remains unconfirmed.
This expanded breach follows a pattern of threats against hardware wallet owners. In February, owners of both Trezor and rival hardware wallet Ledger reported receiving forged letters demanding fictitious security checks. Trezor warned affected customers about risks to their physical security in light of these incidents and reiterated that wallet backups should never be shared or entered into websites.
Uncertainty remains regarding whether ShipMonk had indeed deleted the records as per its contract and data policy. The attribution of extortion emails to ShinyHunters also remains unconfirmed. Trezor has emphasized that its own systems were not breached and that customer private keys and wallet backups are secure.
Why This Matters
This expanded data breach at Trezor’s shipping provider, ShipMonk, underscores the persistent risks to customer privacy and physical security. The exposure of personal information, including home addresses, for an additional 67,000 customers highlights the potential for long-term exploitation of data and challenges previous assurances about data handling practices. The incident serves as a critical reminder of the vulnerabilities inherent in third-party data management and the tangible threats faced by hardware wallet owners.
Broader Context
Source materials place the factual news in this context: Trezor repeatedly asked for and received written confirmation that those records had been deleted, in line with its contract and data policy, and said it was disappointed to learn they had not been. The intrusion traces to a critical SQL injection flaw in the analytics tool Metabase, disclosed on August 6, which let unauthenticated attackers steal credentials for connected databases. Uncertainty remains regarding whether ShipMonk had actually deleted the records as per contract and data policy, and the attribution of extortion emails to ShinyHunters remains unconfirmed.
