ShipMonk Breach Exposes Data of 67,000 More Trezor Customers
Summary
Trezor says a ShipMonk breach exposed personal data for 67,000 more U.S. customers. The intrusion reportedly exploited a Metabase zero-day; Trezor warns of phishing and impersonation risks.
Key points
- Trezor says the ShipMonk breach exposed names, email addresses, phone numbers, shipping addresses and order numbers for 67,000 additional U.S. customers.
- The data related to orders from November 2019 through August 2021.
- Trezor said its hardware wallets were not affected; it notified affected customers and warned of phishing, fake calls, letters and impersonation scams.
- The incident followed unauthorized access ShipMonk reported to Trezor on August 10, 2026; ShipMonk had not publicly acknowledged it at the time of the article.
- The article says the intrusion involved exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase.
- Holborn attributed the breach to the ShinyHunters extortion gang; that attribution is presented as a claim.
Article Details
- Victim Organization
- Trezor customers; the breach occurred at shipping provider ShipMonk
- Incident Type
- Third-party supply-chain breach involving unauthorized access and alleged zero-day exploitation of a SQL injection vulnerability in Metabase
- Data Types Exposed
- Names
- Email addresses
- Phone numbers
- Shipping addresses
- Order numbers
- Affected Records
- 67,000 U.S. customers in the newly disclosed exposure; Trezor had separately disclosed 13,689 customers with fully or partially exposed data the previous month.
- Operational Impact
- Trezor said the breach did not affect the security of its hardware wallets. ShipMonk was reported to have secured the affected systems and improved security.
- Ransom Or Extortion
- Holborn attributed the breach to the ShinyHunters extortion gang and said the attackers extorted the organization; the article does not report independent confirmation of extortion.
- Claim Status
- confirmed