Hardware wallet maker Trezor has disclosed a data breach affecting almost 14,000 customers after attackers accessed systems belonging to its shipping and logistics provider, ShipMonk.
The Trezor data breach exposed customer order information, including names, email addresses, phone numbers and shipping addresses. Trezor said its own systems were not compromised and that customers’ hardware wallets remain secure.
The incident affects customers in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal who received orders between 10 May and 8 August 2026.
Nearly 14,000 customers affected
ShipMonk informed Trezor about unauthorised access to systems containing customer data on 10 August.
According to Trezor, 11,742 customers experienced full exposure of their name, email address, phone number and shipping address. Another 1,947 customers had partial information exposed, consisting of their name, city and email address.
Trezor said the incident did not disrupt its operations or services. It also stressed that attackers did not access its internal systems or compromise Trezor devices.
However, the exposed data could help criminals create convincing phishing campaigns. Attackers may use a victim’s name, address and purchase history to impersonate Trezor, a bank, a cryptocurrency exchange or another trusted organisation.
Trezor warned affected customers to be especially cautious with unsolicited emails, phone calls and letters requesting personal or financial information.
ShipMonk breach linked to Metabase flaw
Trezor has not disclosed the full technical details of the ShipMonk compromise. However, ShipMonk told affected customers that attackers exploited a vulnerability in the third-party analytics platform Metabase.
The company said Metabase notified it of the breach on 6 August. ShipMonk added that the vendor had patched the vulnerability and invalidated active sessions, while the logistics company launched an investigation with external cybersecurity specialists.
The Metabase issue was a critical SQL injection zero-day vulnerability. Attackers reportedly used it to gain administrator-level access to affected customer instances and steal data.
Framework and Tally have also notified customers about data breaches linked to compromised Metabase instances. ShipMonk has reportedly received extortion emails from the ShinyHunters group following the incident.
Crypto users face increased phishing risk
The Trezor data breach presents a particular risk because criminals frequently target cryptocurrency users with social-engineering attacks.
Scammers may try to persuade victims to share wallet recovery seeds, enter them into a fake support site or install malicious software. A legitimate wallet provider will never ask a customer to reveal a recovery seed.
Trezor previously disclosed a third-party support portal breach in January 2024. That incident potentially exposed the names, usernames and email addresses of around 66,000 users who had contacted Trezor Support since December 2021.
Attackers later used the stolen information in phishing attacks designed to steal users’ 24-word recovery seeds.
Customers affected by the latest ShipMonk incident should independently verify any message that appears to come from Trezor. They should avoid clicking unexpected links, never share recovery phrases and contact the company through its official website if they are unsure.
0 responses to “Trezor data breach exposes customer data after ShipMonk hack”