Trezor confirms customer data exposure
Hardware wallet maker Trezor disclosed on 13 August 2026 that customer data held by one of its shipping providers, ShipMonk, had been accessed by an unauthorised party. ShipMonk informed Trezor on 10 August. Trezor says its own systems were not compromised and its devices are not affected.
The first notice covered customers in the US, the UK, Sweden, Colombia, Brazil, Italy and Portugal who placed orders between 10 May and 8 August 2026: 11,742 customers had full names, email addresses, phone numbers and shipping addresses exposed, and 1,947 had their name, city and email address exposed. Trezor later clarified that the partial-exposure group includes older orders.
On 4 September 2026 Trezor updated its notice. ShipMonk had told it on 2 September that the breach also contained order data from an earlier period of cooperation, November 2019 to August 2021, despite written assurances that this data had been removed. That data affects roughly 67,000 more US customers, with name, email address, phone number, shipping address and order number exposed. Across both notices, that is more than 80,000 customers. Trezor says all affected customers have been emailed from help@trezor.io and warns that the data could be used for phishing emails, calls and letters.
The ShipMonk and Metabase connection
Trezor has not said how ShipMonk was breached. In breach notification emails reviewed by BleepingComputer, ShipMonk told its customers that attackers had exploited a vulnerability in Metabase, the third-party analytics platform, and that Metabase informed it of this on 6 August 2026. ShipMonk said Metabase had since patched the flaw and invalidated active sessions. Metabase has disclosed that attackers exploited a critical SQL injection zero-day to breach customer instances, and SecurityWeek reports that this is likely the flaw involved.
ShinyHunters' claim
The ShinyHunters extortion group has claimed responsibility for an attack on Metabase and has leaked data that it says was stolen from the analytics provider, according to SecurityWeek. BleepingComputer reports that ShipMonk has also received extortion emails from ShinyHunters. These are the group's claims; Trezor has not attributed the breach to any group.
Key points
- ShipMonk told Trezor on 10 August 2026 that customer data in its systems had been accessed.
- The first notice covered 11,742 customers with full exposure and 1,947 with partial exposure.
- On 4 September Trezor added roughly 67,000 US customers whose 2019 to 2021 order data ShipMonk still held, bringing the total above 80,000.
- ShipMonk attributed the breach to a vulnerability in Metabase; ShinyHunters has claimed an attack on Metabase.
- Trezor says its own systems and devices were not compromised, but affected customers face a higher risk of phishing.
Further reading & sources
- Recent customer data exposed in shipping provider incident (Trezor)
- 14,000 Trezor Customers Impacted by Data Breach at ShipMonk (SecurityWeek)
- Trezor discloses data breach affecting nearly 14,000 customers (BleepingComputer)