Trezor Data Breach Widens to 67,000 More US Customers

Trezor led with one reassurance. Its own systems, devices, private keys, and wallet backups stayed safe. The leak involves customer shipping data, not the crypto itself.

What Trezor Disclosed on Friday

Trezor posted the news on X and updated its living security advisory. The company said ShipMonk warned it two days earlier, on September 2, that the breach reached further than anyone thought.

The newly exposed group ordered a Trezor device between November 2019 and August 2021. All of them are US customers. So the fresh cohort sits years apart from the first batch.

Trezor first went public on August 13. That disclosure named 11,742 full exposures and 1,947 partial ones, or 13,689 people. Those orders spanned May to August 2026 across the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal.

What Data the Trezor Data Breach Exposed

For the new 67,000 US buyers, the leak is complete. It includes each customer’s name, email, phone number, shipping address, and order number.

Trezor drew a hard line around what stayed protected. The Trezor data breach did not touch its own systems, its hardware, private keys, or recovery seeds. Parcel contents also stayed sealed.

Amazon shoppers can relax too. A different partner fulfills Trezor’s Amazon storefront, so those orders sit outside this incident, according to Trezor.

How Attackers Reached ShipMonk

The entry point sat with a third tool, not with Trezor or even ShipMonk directly. ShipMonk told customers that attackers exploited a flaw in Metabase, a business analytics platform.

Metabase flagged the unauthorized access to ShipMonk around August 6. Later reporting tied the intrusion to a SQL-injection zero-day that handed attackers admin access. SecurityWeek also noted that the extortion crew ShinyHunters claimed a related Metabase attack, though that link remains unconfirmed.

Analytics tools like Metabase often hold broad read access to production databases. So a single injection bug can dump customer tables without ever touching a wallet’s secure chip.

The Deletion Promise Trezor Says ShipMonk Broke

Trezor’s sharpest frustration centers on data that should not have existed. Throughout the relationship, Trezor says it repeatedly asked for and received written confirmation that ShipMonk deleted old order data.

We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.

That older cooperation, back in 2019 to 2021, predated Trezor’s current 90-day retention policy. Still, Trezor says it requested deletion when the arrangement ended, and ShipMonk confirmed the job in writing.

So the 2026 leak of 2019 records undercuts the earlier reassurance. Decrypt wrote that Trezor’s retention argument now looks considerably weaker. Cybersecurity News reached a similar view.

Why Home Addresses Put Wallet Owners at Risk

A leaked address list matters more for hardware wallet buyers than for most shoppers. These customers self-custody crypto, and now their names sit next to a doorstep.

Scammers can craft convincing phishing that cites a real order number and street. They can also pose as Trezor, a bank, or a courier by mail, call, or text.

The threat even reaches the physical world. Trezor warned customers to watch for fake emails, fraudulent letters, and potential risks to physical security. Analysts often call this the wrench attack, where a thief simply targets a known holder in person.

The seeds themselves never sat in ShipMonk’s systems. So the danger here is social engineering and coercion, not a remote drain of the device.

A Pattern of Third-Party Breaches

This marks the third time a vendor has leaked Trezor customer data. A 2022 Mailchimp phishing attack exposed roughly 106,856 customers. A 2024 support-portal breach exposed up to 66,000 names and emails, and attackers emailed 41 users asking for recovery seeds.

Observers keep drawing one comparison. Ledger suffered a 2020 e-commerce database leak that spilled names, emails, addresses, and phones. That dump fueled years of phishing and physical threats, and CoinDesk places this Trezor data breach in the same lineage.

What Trezor Is Doing Next

Trezor is pushing a fix it calls Anonymous Delivery. The option promises locker pickup, neutral packaging, a generic sender, and auto-deletion of shipping IDs.

The company aims to launch it in the EU by September 2026 and in the US late in 2026. Meanwhile, affected customers should receive an email from help@trezor.io, though Trezor says those messages can take time to arrive.

For now, treat every unexpected Trezor message with suspicion, and never enter a recovery seed anywhere but the device. None of this is financial advice, yet the security math is simple. Guard the seed, verify the sender, and assume scammers already know your address.