Trezor informs nearly 14,000 users of a data breach at ShipMonk, exposing sensitive personal information but confirming its own systems remain secure.
Trezor has alerted nearly 14,000 customers following a data breach at its fulfillment partner, ShipMonk, which compromised sensitive personal information, including phone numbers and shipping addresses.
First Exposure of Customer Data for Trezor
This incident marks the first time Trezor has revealed customer phone and shipping details, raising significant concerns about potential phishing attacks, although no misuse of the compromised data has yet been confirmed.
ShipMonk experienced unauthorized access to its systems, affecting 11,742 customers whose names, email addresses, phone numbers, and shipping addresses were exposed. An additional 1,947 customers had their names, cities, and email addresses compromised, bringing the total to approximately 14,000 individuals across various countries, including the U.S., UK, Sweden, and Brazil.
Trezor communicated the breach on X, stating, "We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data." The company has reached out to all affected individuals via email, assuring those who did not receive notifications were not impacted.
Despite the breach, Trezor confirmed that its own systems remain secure and there have been no reports of the exposed data being sold or published. Customers who purchased through Amazon are also unaffected, as those transactions are handled by a different partner.
This breach occurs amidst a rise in global data breaches, with cybersecurity firm SentinelOne reporting a 17% increase in incidents this year alone. Trezor's experience reflects a growing trend, as data breaches have escalated by 3% each month since January.
While Trezor's internal systems have not been compromised, there is a heightened risk of phishing attempts targeting affected customers. Scammers could leverage the leaked information to impersonate banks or cryptocurrency exchanges, creating potential vulnerabilities for the victims.
The ramifications of such breaches can be extensive, with hardware firms facing legal and reputational costs that can exceed $33 million. Additionally, crypto holders face an increased threat of physical attacks, with losses from in-person coercion attacks totaling $124 million in the first half of this year, according to Certik.
This breach is notable as it is the first to expose customer phone numbers and shipping addresses in Trezor's 13-year history. However, the parent company, Satoshi Labs, has previously reported other security incidents affecting customer data.
In a parallel situation, Ledger, another major hardware wallet manufacturer, also faced a data breach linked to a third-party partner earlier this year, further illustrating the risks associated with handling customer information in the cryptocurrency space.
