Trezor Data Breach Expands, Impacting 67,000 Additional Customers

Key Highlights

• Trezor disclosed that an additional 67,000 U.S. customers have been impacted by a data breach linked to ShipMonk.
• The exposed records include personal details from orders placed between November 2019 and August 2021.
• The company had previously received assurances from ShipMonk regarding data deletion.

Trezor has announced a significant increase in the number of customers affected by a recent data breach, with an additional 67,000 individuals in the U.S. now at risk. This incident results from a breach at ShipMonk, the shipping provider, which exposed personal information such as names, email addresses, phone numbers, and home addresses related to orders made between November 2019 and August 2021. Trezor's update follows ShipMonk’s notification two days earlier.

Two days ago, we received an update from our shipping provider, ShipMonk. We're deeply saddened to share the news that the recent data breach affects more customers than originally thought.

Another 67,000 customers from the US who ordered between November 2019 and August 2021…

— Trezor (@Trezor) September 4, 2026

Concerns for Wallet Owners

While Trezor's systems remain secure and no wallets or private keys were compromised, the breach raises concerns about the potential for phishing attacks targeting hardware wallet owners. Trezor urged customers to be vigilant, as the leaked data could lead to attempts to deceive users through emails and other communications. The company emphasized that wallet backups should never be shared or entered on any website.

Fraudulent letters have been reported previously by Trezor and its competitor Ledger, which included misleading prompts for customers to activate unnecessary security checks. Cybercrime expert David Sehyeon Baek highlighted the physical risks associated with the breach, noting that personal information can remain valuable for years.

The breach is linked to a serious SQL injection vulnerability in the Metabase analytics tool, disclosed on August 6, which allowed unauthorized access to connected databases. Other companies, including Framework and Tally, were also affected by this security flaw. ShipMonk has reportedly received extortion communications from the hacker group ShinyHunters, although this claim remains unverified.

In response to these events, Trezor plans to accelerate the rollout of anonymous delivery options, enabling customers to use neutral packaging and generic sender information to protect their home addresses.