Trezor customers hit with phishing after shipping partner breach

Trezor maker SatoshiLabs has warned that around 67,000 additional US customers are at risk of phishing attacks after their personal data was exposed in a breach at shipping partner ShipMonk. The leaked information includes names, email addresses, phone numbers and shipping addresses, which could be used for scam emails, fraudulent calls or letters, and may pose physical security risks.

The breach, first disclosed in August, stemmed from attackers exploiting an SQL injection zero-day in Metabase’s Cloud SaaS platform. ShipMonk failed to delete customer data as required after 90 days, affecting orders delivered to several countries between May and August, and earlier data for US customers dating back to 2019.

SatoshiLabs confirmed its own systems were not compromised and devices remain secure. The company is working on options such as anonymous delivery and neutral packaging, and advises customers to use anonymous email addresses, pay with cryptocurrency, and use P.O. boxes to reduce risk. Several customers have reported receiving phishing calls and QR phishing letters.