Trezor discloses 67,000 additional customers exposed in ShipMonk breach; total reaches 80,700

Trezor announced on September 4 that 67,000 additional US customers had their names, emails, phone numbers, shipping addresses, and order numbers exposed in a breach at third-party logistics provider ShipMonk. The newly disclosed data spans orders placed between November 2019 and August 2021, extending the breach window far beyond Trezor's stated 90-day data retention policy.

The additional exposure brings the total number of affected customers to approximately 80,700 across multiple regions. Trezor initially disclosed on August 10 that ShipMonk had informed it of customer data exposure affecting roughly 13,689 people. On September 2, ShipMonk revealed to Trezor that the breach actually extended back to 2019 and 2021, expanding the scope by 67,000 US customers plus 1,947 additional records from other regions with names, cities, and emails.

According to Decrypt, the intrusion traces to a critical SQL injection flaw in the analytics tool Metabase, disclosed on August 6, which allowed unauthenticated attackers to steal credentials for connected databases. ShipMonk has reportedly received extortion emails attributed to ShinyHunters, though that attribution remains unconfirmed.

Trezor stated that throughout its entire relationship with ShipMonk, it repeatedly requested and received written assurances confirming data deletion in line with the company's contract and data policy. The company said it was "very disappointed" that despite these confirmations, the data was not deleted in ShipMonk's systems. Bitcoin Magazine reports that Trezor initially claimed its 90-day data policy helped mitigate the leak, but now acknowledges the policy was never enforced and data was never deleted.

The leaked records identify confirmed hardware wallet owners at specific addresses, creating a target list for physical attacks and sophisticated phishing campaigns. Decrypt reported that Trezor and rival Ledger customers were already receiving forged letters in February printed with holograms, QR codes, and forged executive signatures. Cybercrime consultant David Sehyeon Baek told Decrypt that stolen address data remains useful for years because people rarely move or change their numbers.

Trezor confirmed that its own systems were not breached and devices, private keys, and wallet backups remain untouched. The company is working to ship anonymous delivery as quickly as possible, an option using locker pickup, neutral packaging, and generic sender details so customers need not hand over a home address. Trezor is also arranging an additional audit of the mailing partner.