Trezor Says ShipMonk Breach Exposed Data of 81,000 Customers
Summary
Trezor says a ShipMonk breach exposed personal and order details of 81,000 customers. The intrusion reportedly involved a Metabase vulnerability; ShipMonk has received extortion emails attributed to ShinyHunters.
Key points
- Trezor says the breach at its shipping provider, ShipMonk, affected 81,000 customers in total.
- An additional 67,000 U.S. customers had names, email addresses, phone numbers, shipping addresses and order numbers exposed.
- The additional affected customers ordered between November 2019 and August 2021; the earlier disclosure covered nearly 14,000 customers.
- Trezor says ShipMonk did not delete exposed data despite providing written assurances that it had done so.
- Customer notifications reportedly said attackers exploited a vulnerability in the Metabase analytics platform; the article does not detail how ShipMonk’s systems were breached.
- BleepingComputer reports ShipMonk received extortion emails from ShinyHunters, but the gang’s link to the breach is not confirmed.
- Trezor says its own systems and services were not compromised and warns affected customers about phishing and other scams.
Article Details
- Victim Organization
- Trezor
- Incident Type
- Third-party data breach involving unauthorized access and theft of customer data from ShipMonk systems. The breach notification emails reportedly said attackers exploited a vulnerability in Metabase.
- Incident Date
- 2026-08-01
- Disclosure Date
- 2026-08-13
- Data Types Exposed
- Full names
- Email addresses
- Phone numbers
- Shipping addresses
- Order numbers
- Affected Records
- 81,000 customers in total, including an additional 67,000 U.S. customers and nearly 14,000 customers initially disclosed.
- Operational Impact
- Trezor said its systems were not compromised, its operations and services were unaffected, and Trezor devices remain secure. Affected customers were warned of increased phishing and other scam risks.
- Ransom Or Extortion
- BleepingComputer reported that ShipMonk received extortion emails from the ShinyHunters extortion gang. The source does not confirm that a ransom was paid.
- Claim Status
- confirmed
Threat Actors
Products
Countries
BrazilAs the company explained at the time, the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.ColombiaAs the company explained at the time, the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.ItalyAs the company explained at the time, the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.PortugalAs the company explained at the time, the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.SwedenAs the company explained at the time, the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.United KingdomAs the company explained at the time, the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026.