Shipping records exposed 80,689 Trezor customers

Trezor expanded a shipping-provider breach disclosure on Sept. 4 to report that contact and delivery details for 80,689 customers were exposed. The company said about 67,000 of those records were additional U.S. orders placed between 2019 and 2021. ShipMonk, the fulfillment partner that handled deliveries, provided written assurances that it deleted the records.

Trezor reported the leaked dataset contained only names, addresses, phone numbers and other contact and shipping information. The company noted its systems and hardware devices were not affected and that parcel contents were not exposed. Trezor also stated no funds were stolen or misappropriated.

Hardware wallets store the private keys that control cryptocurrency on a dedicated device rather than on a computer. To restore a wallet if a device is lost or damaged, users rely on a recovery phrase, usually a sequence of words that can recreate the wallet on another device. Anyone who obtains that recovery phrase can restore access and move the coins the wallet controls.

The exposed contact and delivery details do not provide direct access to keys, but they can make social-engineering scams more effective. Records that include a recipient name, delivery address or order reference can make an email, phone call or physical letter look legitimate. Security incidents have included fraudsters sending letters or messages that direct recipients to scan a QR code or visit a website and then request a recovery phrase.

Shipping information often persists beyond the immediate need to deliver a parcel. Sellers commonly outsource warehousing and deliveries to third parties and copies of routing data can appear in backups, customer support systems and database replicas. Contracts frequently include deletion clauses, and a vendor may confirm compliance, but that confirmation does not itself prove all copies of the data were removed. Federal guidance for businesses recommends collecting sensitive information only when necessary, tracking where it goes and disposing of it securely; the guidance applies to service providers as well.

Buyers can reduce exposure by using parcel lockers, requesting neutral packaging or providing separate contact details for deliveries, though these options have limits. Locker operators may require identification, payment processors keep billing records, and blank packaging does not remove records already stored by a seller or its partners. Vendors can limit the data they collect, separate sensitive fields so they do not travel together, set specific retention periods and require proof that contractors have deleted records when a contract ends.

Shipping records can remain a source of privacy and fraud risk long after a device is unboxed. Customers should be alert to unsolicited contact that references past orders and must not share recovery phrases or other secret wallet details with anyone.