Trezor: ShipMonk breach exposed records of ~80,689 customers

Trezor reported that a breach at logistics partner ShipMonk exposed contact and order data for roughly 67,000 additional U.S. customers whose orders ran from November 2019 to August 2021. The company’s disclosures imply a combined total of about 80,689 affected customers when paired with an earlier group.

The exposed fields include full names, email addresses, phone numbers, shipping addresses and order numbers. In its initial disclosure on Aug. 13, Trezor identified 13,689 affected customers, later clarifying that 11,742 had full exposure and 1,947 had partial exposure.

On Sept. 4 Trezor updated its assessment after discovering older records remained in ShipMonk’s systems despite written assurances that those files had been deleted. The company has not published a single combined figure or released row-level data to show whether the two disclosed groups overlap, and it described the newly reported records as separate from the original cohort.

Trezor’s delivery-data policy requires customer delivery details to be removed from both the company’s systems and its fulfillment partners’ systems after 90 days, except for unresolved orders. Trezor says it repeatedly requested and received written confirmations from ShipMonk that the records were deleted; those confirmations have not been made public.

ShipMonk traced the unauthorized access to a vulnerability in the analytics platform Metabase. Metabase acknowledged an August zero-day that could allow creation of a session tied to an administrator account and permit bulk table downloads. After reassessing retained historical tables, ShipMonk revised upward the number of Trezor customer records known to be exposed.

Trezor stated that its internal systems, products and services were not breached and that device security and wallet funds were not compromised. The exposed data did not include wallet recovery seeds, private keys or account balances.

The company warned that the combination of a purchaser’s name, shipping address and evidence of a hardware-wallet purchase could increase the risk of targeted scams, convincing phishing messages, fraudulent calls or letters and potential physical targeting. Trezor has not identified any confirmed downstream attacks tied to the dataset.

Trezor said it emailed every newly affected customer directly and advised that anyone who did not receive a notice was not impacted. The company reminded customers not to share wallet backups or enter seed phrases on websites.

Trezor noted that retained historical order records at fulfillment providers can connect identifiable purchasers and delivery addresses to hardware-wallet purchases even when core wallet infrastructure remains secure.