BreachPublished 14 Aug 2026

14,000 Trezor Customers Impacted by Data Breach at ShipMonk

Source SecurityWeek

Description

Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers. The post 14,000 Trezor Customers Impacted by Data Breach at ShipMonk appeared first on SecurityWeek .

Impact

The breach exposed sensitive personal information of nearly 14,000 Trezor customers, including names, addresses, email addresses, and phone numbers. This data exposure increases the risk of targeted phishing attacks and social engineering attempts against affected individuals. There is no indication that Trezor's hardware wallets or internal systems were compromised, so the security of the devices themselves remains intact. The breach is limited in scope due to Trezor's data retention policies. However, the exposure of personal data can lead to privacy violations and potential fraud.

Defensive guidance

Trezor has notified all impacted customers and advised them to be vigilant against phishing and suspicious communications requesting personal information or urgent actions. Customers should follow these warnings and avoid responding to unsolicited requests. Trezor and ShipMonk are investigating the breach to determine the full scope and timeline. The vulnerability in Metabase exploited by attackers has been patched; organizations using Metabase should ensure they have applied the latest security updates. No action is required to secure Trezor devices themselves as they were not affected.

Summary

The breach involved unauthorized access to customer shipping information held by ShipMonk, Trezor's third-party fulfillment partner. Attackers exploited a vulnerability in Metabase, a data analytics platform used by ShipMonk, likely the recently patched SQL injection zero-day. Approximately 11,742 customers had full personal details exposed, while 1,947 had partial data exposure including names, cities, and email addresses. Trezor's internal systems and devices were not compromised. The breach affects customers who placed orders between May 10 and August 8, 2026. Trezor enforces a 90-day data retention policy, which limits the amount of data exposed. The extortion group ShinyHunters claimed responsibility for the Metabase attack. ShipMonk has not publicly acknowledged the breach. Trezor has alerted affected customers and advised caution against phishing attempts.

References

securityweek.com/14000-trezor-customers-impacted-by-data-breach-at-shipmonk/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Aug 2026, 08:26 UTC

References

Community reviews