Trezor warns customers of phishing after email provider breach
Summary
Trezor says attackers breached its third-party email provider and sent customers fake STM32 vulnerability alerts. The company took down the phishing domain and is investigating; the article also details earlier breaches affecting Trezor customers.
Key points
- Trezor said attackers breached its third-party email provider and sent customers phishing emails impersonating a “Critical Security Alert.”
- The emails claimed a fake STM32 microcontroller vulnerability could expose wallet recovery seeds to brute-force attacks.
- Trezor said the emails were not legitimate, warned customers not to click links, took down the domain, and is investigating how attackers accessed it.
- A ShipMonk breach exposed Trezor customer order and contact details; a follow-up investigation raised the reported affected total to 81,000 customers.
- The article says breach notification emails attributed the ShipMonk intrusion to exploitation of a Metabase vulnerability; Metabase separately described exploitation of a critical SQL injection zero-day.
- Trezor previously disclosed a 2024 support-portal compromise that exposed data belonging to roughly 66,000 users.
Article Details
- Victim Organization
- Trezor
- Victim Domain
- trezor.io
- Incident Type
- Third-party email-provider breach followed by phishing; separate data breaches involving ShipMonk and Trezor's support portal
- Data Types Exposed
- Full names
- Shipping addresses
- Email addresses
- Phone numbers
- Usernames
- Order data
- Affected Records
- The ShipMonk breach affected 81,000 customers in total, including an additional 67,000 U.S. customers identified in a follow-up investigation. A separate 2024 support-portal breach affected approximately 66,000 users.
- Operational Impact
- Trezor took down the domain associated with the phishing activity and said it was investigating the email-provider breach and how attackers accessed its legitimate domain.
- Ransom Or Extortion
- BleepingComputer reported that ShipMonk received extortion emails from ShinyHunters after the breach. The article does not report a ransom demand amount or payment.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Vendors
Products
Countries
BrazilAs Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.ColombiaAs Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.ItalyAs Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.PortugalAs Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.SwedenAs Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.United KingdomAs Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.