Trezor has disclosed that a data breach at its third-party shipping provider, ShipMonk, exposed personal information belonging to approximately 67,000 additional US customers, substantially expanding the scope of an incident first reported in August.
The newly identified records relate to orders processed during Trezor’s previous partnership with ShipMonk, from November 2019 to August 2021.
The affected data includes customers’ full names, email addresses, phone numbers, shipping addresses, and order numbers, creating heightened risks of targeted phishing, phone scams, fraudulent mail, and potential physical-security threats.
ShipMonk Data Breach
Trezor said ShipMonk informed it on September 2 that the breach included older order data that had previously been believed to have been deleted.
According to Trezor, the hardware wallet maker repeatedly obtained written assurances from ShipMonk that historical customer information had been deleted under contractual obligations, its data-retention policy, and prior communications.
However, the data remained in ShipMonk’s systems and was subsequently accessed by an unauthorized actor.
“This leaked data affects another approximately 67,000 US customers,” Trezor said in an update published September 4. The company stated that it has emailed every affected customer directly. Customers who did not receive an incident notification from help@trezor.io are not believed to be impacted.
The disclosure changes the incident from a limited recent-order breach into a significantly broader third-party data-retention failure involving years-old customer records.
Trezor originally disclosed the ShipMonk incident on August 13 after the logistics provider reported unauthorized access to systems containing customer order data on August 10.
The initial assessment identified 11,742 customers whose names, email addresses, telephone numbers, and full shipping addresses were exposed. Another 1,947 customers had partial exposure involving their names, cities, and email addresses.
At the time, Trezor attributed the limited scale to its 90-day data-storage policy, which requires fulfillment partners to delete or anonymize order-related customer data after delivery, returns, refunds, and replacements are completed.
Trezor later acknowledged that some of the partially exposed records could be linked to older orders. The latest update confirms that a much larger dataset from the 2019–2021 fulfillment period was retained despite assurances of deletion.
Trezor emphasized that its own systems, products, and hardware wallets were not compromised. Wallet backups, private keys, device security, and the contents of customer parcels were not exposed in the ShipMonk breach.
Nevertheless, the combination of identity, contact, and physical address data is particularly sensitive for cryptocurrency hardware wallet customers.
Threat actors could use the records to craft convincing messages impersonating Trezor, cryptocurrency exchanges, banks, delivery firms, or law-enforcement agencies.
Potential lures include false device security alerts, fake firmware update prompts, requests to “verify” a wallet backup, fraudulent delivery notices, and phone calls claiming a customer’s assets are at risk.
Trezor advised affected users to treat unsolicited communications with caution and never enter a wallet backup online or disclose it to another person.
Customers should verify security notices on Trezor’s official website, social media channels, and support portal rather than using links or telephone numbers provided in unexpected messages.
The incident highlights the security exposure created when cryptocurrency companies rely on third-party logistics providers and when retention controls and deletion commitments are not independently verified.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
