Trezor discloses ShipMonk breach affecting 67,000 US customers

Hardware wallet maker Trezor has disclosed that a breach at its shipping provider ShipMonk exposed the personal data of 67,000 US customers. The information includes names, email addresses, phone numbers, shipping addresses and order numbers from between November 2019 and August 2021.

Trezor said it had repeatedly requested and received written assurance from ShipMonk that the data had been deleted in line with its 90-day retention policy, but the data was not removed. The breach follows an earlier disclosure affecting 13,689 customers, and does not affect the security of the hardware wallets themselves.

ShipMonk informed Trezor of the breach on August 10, 2026, after unauthorised access to its systems. The incident involved the exploitation of a critical SQL injection flaw in Metabase, and enterprise blockchain security firm Holborn has linked the attack to the ShinyHunters extortion gang.

Trezor has notified affected customers and warned them to be alert for phishing and social engineering attempts that could exploit the leaked information.