More than 80,000 Trezor customers in the US have had their personal data exposed after a breach at shipping provider ShipMonk. An additional 67,000 users were recently identified, bringing the total known affected to roughly 80,689. Exposed information includes names, email addresses, phone numbers, shipping addresses, and order numbers from orders placed between November 2019 and August 2021. ShipMonk retained years-old records despite providing Trezor with written assurances that the data had been securely deleted. Trezor’s own systems and wallet backups remain secure, but the leaked details could be used for targeted phishing scams or physical risks.
Trezor announced that another 67,000 US customers had their personal information exposed through a breach at its shipping provider, ShipMonk. Since the problem was first reported in early August, more than 80,000 customers have been impacted overall.
There continue to be question marks over why ShipMonk still kept years-old order records even though they told Trezor that the data had been securely deleted. The newly identified customers placed orders between November 2019 and August 2021.
Exposed information includes names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor said it received more findings from ShipMonk two days before publishing its latest update, and that everyone in the new group has been contacted directly by email.
This new disclosure follows an earlier announcement involving 13,689 customers. Out of that group, 11,742 had their names, contact details, and shipping addresses exposed, while the remaining 1,947 had fewer compromised details.
With the latest group, the total number known now stands at about 80,689 customers. Some of the records that were just exposed were almost seven years old.
Trezor said it had repeatedly asked ShipMonk to erase the information and received written assurances that it had done so. The company called the discovery that this was not the case disappointing.
Trezor stated that its own systems were unaffected by the breach, and customer wallet backups were not exposed. The attacker did not have direct access to users’ crypto.
However, the stolen personal information could still be used to create convincing scams. Knowing a customer’s name, their orders, and how to contact them can be sufficient to assume Trezor’s identity in emails, calls, or even letters.
More concerning are the shipping addresses that have been exposed, because they can be used to identify homes where hardware wallets are kept. Trezor advised customers never to reveal their wallet backup or enter it on a website, regardless of who requests it.
Anyone who did not receive a notification email is not believed to be affected. The company says it is now working to introduce anonymous delivery, which would allow buyers to order devices without sharing as much personal information.
