Trezor Customer Data Leak Widens After Shipping Partner Breach
A breach at Trezor's shipping partner ShipMonk exposed the information and shipping addresses of 13,689 customers. It later emerged that the information of about 67,000 additional US customers, which had been described as deleted, was also exposed. Trezor disclosed the widening scale of the damage.
Key facts
- Affected organisation
- Trezor
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Information of 13,689 customers and about 67,000 additional US customers
- Cause / method
- Breach via a Metabase vulnerability at shipping partner ShipMonk
- Location
- Other countries
If your data was exposed
Exposed dataAddress
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- Trezor said the information of 13,689 customers was leaked through a breach at its shipping partner.
- The breach method involving a Metabase SQL injection at ShipMonk was disclosed.
- It was disclosed that the information of about 67,000 more Trezor customers was exposed.
- It emerged that the additional leaked US customer information was data that had been described as deleted.
16 related reports
- Shipping delays caused by data breach: ‘Expect fake messages’
- Watch Bitcoin Will 'Survive' Cold Wallet Hack: Alex Thorn
- Third-party breach exposes shipping addresses of 14,000 Trezor buyers
- Data Breach At Trezor Leaks Info On Nearly 14,000 Bitcoin Wallet Users
- Trezor discloses data breach affecting nearly 14,000 customers
- Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed
- Trezor says 13,689 customers hit by data breach at shipping partner
- 14,000 Trezor Customers Impacted by Data Breach at ShipMonk
- Crypto Firm Trezor Says Data Breach Exposed Thousands of Clients
- Trezor Data Breach Analysis: 14,000 Customers Exposed in ShipMonk Metabase SQL Injection Incident
- 67,000 more Americans using Trezor exposed to data breach
- 67,000 More Trezor Customers Exposed as Data Breach Widens
- Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
- Trezor ShipMonk Breach Exposes 67,000 U.S. Customer Records via Metabase Zero-Day Vulnerability (CVE-2026-72898)
- Trezor Hack Scare: That STM32 Entropy Email Is a Phishing Attack
- Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Other incidents at Trezor
Trezor confirms three tampered wallets in October report investigation, updates response
Impact: Malicious devices identified in three Safe 5 hardware wallets
Trezor said its investigation into a wallet-tampering report received on 28 October identified malicious hardware devices in three Safe 5 wallets sold by Cryptobilis. The devices collect information including recovery phrases displayed on the screen and transmit it to attackers over mobile networks. Trezor released firmware on 11 November to block the devices’ data collection and said no related losses of funds had been reported to date.
Read on BleepingComputer ↗Trezor email provider breach leads to scams targeting crypto owners
Impact: Hundreds of thousands of cryptocurrency owners targeted by fraudsters
Trezor confirmed a data breach at its email provider. After the breach, fraudsters targeted hundreds of thousands of cryptocurrency owners. The specific data exposed and the scale of financial losses have not been confirmed.
Read on TechCrunch ↗Trezor's X account hacked and used to promote crypto scam
Impact: X account used to promote a cryptocurrency scam
Trezor's X account was hacked and used to promote a cryptocurrency scam. The amount of financial damage and whether the account has been recovered have not been confirmed.
Read on Yahoo Finance ↗Trezor support site breach leaks personal data of 66,000 customers
66kImpact: Email addresses and names of 66,000 customers
Trezor's support site was breached, leaking the personal information of 66,000 customers. The leaked information included email addresses and names, and the specific response has not been confirmed.
Related reports: 2 →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.