The Trezor data breach has expanded significantly after shipping provider ShipMonk discovered that older customer records remained stored despite previous deletion assurances. According to reports from AMBCrypto, another 67,000 US customers had their personal information exposed through the breach at ShipMonk. Since the problem was first reported earlier in August, more than 80,000 customers have been impacted by the security incident. The newly identified records date from November 2019 through August 2021, showing that older customer data remained in ShipMonk's systems despite Trezor's deletion requirements under their 90-day retention policy. As reported by BigGo Finance, the discovery directly contradicts assurances Trezor said it received from ShipMonk, with the company stating it had repeatedly obtained written confirmation from the fulfillment partner that older shipping data had been deleted in line with contractual requirements and their data retention policy. Following the last disclosure, Trezor said it learned September 2 that the ShipMonk breach was larger than initially reported, raising questions about the company's advertised 90-day data retention policy with fulfillment partners.
The newly identified customers placed orders between November 2019 and August 2021, with 12,742 customers having their names, email addresses, phone numbers, and shipping addresses exposed, while 1,947 had more limited information compromised. As reported by AMBCrypto, exposed information includes names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor said it received more findings from ShipMonk two days before publishing its latest update, and everyone identified in the new group has been contacted directly by email. This new disclosure comes after an earlier announcement that involved 13,689 customers, with 11,742 having their names, contact details, and shipping addresses exposed, while the remaining 1,947 had fewer compromised details. According to BigGo Finance, all newly affected customers have been contacted directly by email, and users who have not received a notification are not believed to be impacted. The information exposed does not allow an attacker to remotely access a Trezor wallet, but the type of information creates different problems - leaked phone numbers and home addresses could potentially put affected customers at physical risk, while real order numbers and contact details could help scammers impersonate the company more convincingly.
According to AMBCrypto, Trezor confirmed that their own systems were unaffected by the breach, and customer wallet backups were not exposed. The attacker did not have direct access to customer cryptocurrency. The company said its hardware wallets remain secure, and the incident did not expose private keys, wallet backups or device secrets. However, the stolen personal information could still be used to create convincing scams, as knowing customer names, orders, and contact details can be sufficient to assume Trezor's identity in emails, calls, or letters. As reported by BigGo Finance, the exposure occurred entirely within ShipMonk's fulfillment infrastructure, with Trezor's own systems, firmware, private keys, and wallet backups remaining completely secure. The breach originated outside Trezor - attackers exploited a previously unknown SQL-injection vulnerability in Metabase, an analytics platform used by ShipMonk. Metabase notified ShipMonk around August 6, patched the vulnerability and invalidated sessions, while ShipMonk later explained that it secured its systems.
As reported by AMBCrypto, the most concerning aspect are the shipping addresses that have been exposed, as they can be used to identify homes where hardware wallets are kept. Trezor advised customers never to reveal their wallet backup or enter it on a website, regardless of who requests it. The company says it is now working to introduce anonymous delivery, which would allow buyers to order devices without sharing as much personal information. Trezor warned affected users to expect fake emails, fraudulent calls and physical letters, highlighting possible physical-security threats that make this exposure more than a conventional account-security problem. The timing of the expanded breach coincides with heightened concerns about targeted phishing campaigns, as names, phone numbers, and physical delivery addresses give attackers enough material to construct highly personalized scams aimed at known hardware wallet owners. Trezor warns that nobody from the company will ask for a wallet backup, meaning customers should never enter their seed phrase into a website or hand it over to someone claiming to provide support.
With the latest group announced, it brings the total number of known affected customers to about 80,689. The incident was first disclosed on August 13, when Trezor said ShipMonk's breach affected about 13,689 customers and initially tied most exposure to recent orders under a 90-day retention policy. Security firm TRM Labs has argued that self-custody does not eliminate risk, but shifts it to different parts of the security chain, as in this case, the wallet itself may remain protected while shipping records expose the owner's identity, contact details and home address. The expanded breach heightens concerns about targeted phishing campaigns, with blockchain security firm Hacken reporting that impersonation-based scams accounted for $306 million of the $482 million in total industry losses during the first quarter of the year. Trezor is developing an Anonymous Delivery option designed to reduce personally identifiable information attached to hardware wallet purchases, with European availability targeted for September 2026 and U.S. rollout expected by the end of 2026. The system includes locker pickup, neutral packaging, a generic sender, and automatic deletion of shipping identifiers after delivery.
