Trezor Reports Data Breach Affecting Nearly 14,000 Customers

Trezor, a leading hardware wallet manufacturer, has announced a data breach affecting 13,689 customers, linked to a security incident at their logistics partner, ShipMonk. The news was made public on August 13, when Trezor confirmed that the breach was a result of unauthorized access to ShipMonk's systems that occurred on August 10.

The compromised data includes sensitive order information from purchases made between May 10 and August 8, impacting customers from the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal. Out of the total affected, 11,742 users had their complete personal information stolen, while 1,947 experienced partial data exposure, which included names, cities, and email addresses.

"This incident marks the first time since our founding in 2013 that customers' phone numbers and delivery addresses have been compromised," Trezor representatives stated.

Users have been warned to be vigilant against potential phishing attacks that may arise as a result of this incident. Notifications have been dispatched to those believed to be affected.

Fortunately, the breach's impact was somewhat limited due to Trezor's data retention policy, which requires that order data be deleted or anonymized after 90 days. Thus, older records were not accessible in ShipMonk's systems at the time of the breach.

In response to the breach, ShipMonk has said it will bolster security measures. Trezor continues to investigate the full scope of the issue and plans to introduce a new service, Anonymous Delivery, that allows customers to receive devices from lockers and ensures that delivery information is not stored. This initiative is expected to roll out in the EU by September and in the US by the end of 2026.

Earlier in August, Trezor, alongside other hardware wallet companies, had already alerted users about the risk of phishing attacks following a separate incident involving Coldcard.