ShipMonk, a third-party logistics provider for Trezor, suffered unauthorized access to its systems resulting in exposure of customer order data. The breach affected 11,742 customers with full exposure of name, email, phone number, and shipping address, and an additional 1,947 customers with partial exposure (name, city, email). The incident is limited to orders placed within 90 days prior to August 8, 2026, due to Trezor's data retention policy. Trezor's own infrastructure and hardware wallets remain secure. The exposed data can be used for phishing or impersonation attacks. Trezor is implementing measures to mitigate risks and plans to introduce an anonymous delivery option to reduce data exposure in future shipments.

The breach exposed sensitive personal information of thousands of Trezor customers, including names, contact details, and shipping addresses. Although Trezor devices and systems were not compromised, affected customers face increased risk of targeted phishing, social engineering, and impersonation attacks via email, phone, or postal mail. The breach does not impact the security of Trezor hardware wallets or user funds directly but raises privacy and security concerns for customers.

Trezor has notified all affected customers via email and advises vigilance against phishing attempts. Customers should verify communications against official Trezor channels and never share wallet backups or enter them on websites. ShipMonk has secured affected systems and enhanced security controls. Trezor recommends using anonymous email addresses, crypto payments, disposable cards, or P.O. boxes to limit data exposure when ordering. An anonymous delivery option is planned to be available in the EU by September 2026 and in the US by the end of 2026. No patch is applicable as this is a third-party data breach; mitigation focuses on customer awareness and operational security improvements.