Trezor Customers Affected by Data Breach at Shipping Partner

Overview

• A data breach at ShipMonk, a shipping partner for Trezor, has compromised the personal data of 13,689 customers.
• 11,742 customers had their full names, phone numbers, emails, and shipping addresses exposed.
• Trezor confirmed that its own systems were not affected, and no wallets or private keys were compromised.

Trezor has announced that a data breach at ShipMonk, one of its fulfillment partners, has compromised the personal information of thousands of its customers. The breach, which ShipMonk reported on Monday, exposed sensitive details including full names, phone numbers, email addresses, and shipping addresses.

In total, 13,689 customers were affected, with 11,742 experiencing full data exposure. An additional 1,947 customers had their names, cities, and email addresses compromised. The affected individuals placed orders between May 10 and August 8, with shipments sent to various countries, including the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal.

We regret to inform our customers that one of our shipping providers has suffered a data breach affecting sensitive order data for customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who ordered within the last 90 days.

— Trezor (@Trezor) August 13, 2026

Trezor reassured its users that its systems remain secure, with no devices, private keys, or wallet backups being compromised. The company highlighted its data retention policy, which mandates partners delete or anonymize order data after 90 days, thereby limiting the breach's scope. Customers who did not receive an alert are considered safe, as Trezor emphasized that it had never before experienced a breach that exposed such sensitive information in its 13 years of operation.

Increased Security Concerns

In the wake of this incident, Trezor has cautioned customers about potential phishing attempts, urging them to be vigilant against unexpected communications and to avoid entering wallet backups online. This breach follows a troubling trend in the industry, reminiscent of a previous incident involving Ledger, where personal information of approximately 272,000 customers was exposed. Following that breach, some individuals reported receiving ransom threats and persistent phishing attempts.

2026 has seen a worrying rise in physical attacks on cryptocurrency holders, with reports indicating 52 incidents in the first half of the year, up from 39 the previous year. Home invasions have become more common than kidnappings, with over $30 million stolen during this period, suggesting that 2026 could be the worst year for such crimes.

This breach at ShipMonk is not an isolated incident; Ledger also faced a breach involving its e-commerce partner earlier this year. Additionally, hardware wallet firms are warning about increasing phishing attempts, with losses from the Coldcard exploit nearing $130 million.

In response to the breach, Trezor is fast-tracking the launch of an Anonymous Delivery option, set to feature locker pickups, neutral packaging, and automatic deletion of shipping identifiers, targeting a rollout in the EU by September and the US by the end of the year.