Trezor Says ShipMonk Breach Exposed Data of About 80,000 Customers
Summary
A breach of Trezor fulfillment provider ShipMonk exposed names, contact details, and shipping addresses for about 80,000 customers. Trezor says its systems and wallet devices were not compromised; the investigation is ongoing.
Key points
- The exposed information includes names, email addresses, phone numbers, shipping addresses, and order numbers.
- Trezor reported an initial 13,689 affected customers, followed by about 67,000 additional US customers whose orders dated from November 2019 to August 2021.
- Attackers reportedly exploited a critical SQL injection flaw in ShipMonk’s Metabase platform; the flaw has since been patched.
- Trezor says its own systems, customer private keys, wallet backups, and devices were not compromised.
- Trezor confirmed the breach and contacted affected customers; no confirmed misuse of the stolen data was reported.
- The main risks include targeted phishing and potential physical safety concerns from exposed shipping addresses.
- Trezor advises customers to verify messages through official channels and never enter wallet backups online.
Article Details
- Victim Organization
- Trezor customers; the breach occurred at fulfillment partner ShipMonk
- Incident Type
- Third-party data breach involving unauthorized access to customer order data at ShipMonk, reportedly through exploitation of a Metabase SQL injection flaw
- Disclosure Date
- 2026-09-04
- Data Types Exposed
- Full names
- Email addresses
- Phone numbers
- Shipping addresses
- Order numbers
- Affected Records
- About 80,000 customers in total: 13,689 in the initial wave, plus about 67,000 additional US customers. Of the initial group, 11,742 had full exposure and 1,947 had partial exposure.
- Operational Impact
- Customer order data was accessed. Trezor stated that its own systems were not compromised and that devices, private keys, and wallet backups were not affected. The investigation was ongoing.
- Claim Status
- confirmed