[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftfjHrC41_lukcvf8-QzOLg6Cci-W4pWOMO9kmSZesl4":3,"$fBzSPX_x2nnQ6h3pnZ_78L_OIrP3vQPavnMIriKOZ_Y0":47},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":44,"created_at":45,"updated_at":46,"published_at":24},"trezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers","Trezor Confirms Customer Data Exposed in ShipMonk Breach, Total Now Over 80,000","Shipping provider ShipMonk told customers attackers exploited a Metabase vulnerability; ShinyHunters has claimed an attack on Metabase.","Trezor says its shipping provider ShipMonk suffered a breach that exposed about 13,700 recent customers, and in September 2026 added roughly 67,000 more US customers from older orders; ShipMonk attributed the intrusion to a vulnerability in Metabase, and the ShinyHunters extortion group has claimed an attack on Metabase.",[10,11,12,13,14],"Data Breach","ShinyHunters","Trezor","ShipMonk","Metabase","# Trezor Confirms Customer Data Exposed in ShipMonk Breach, Total Now Over 80,000\n\n*Shipping provider ShipMonk told customers attackers exploited a Metabase vulnerability; ShinyHunters has claimed an attack on Metabase.*\n\n**Tags:** `Data Breach` `ShinyHunters` `Trezor` `ShipMonk` `Metabase`\n\n> Trezor says its shipping provider ShipMonk suffered a breach that exposed about 13,700 recent customers, and in September 2026 added roughly 67,000 more US customers from older orders; ShipMonk attributed the intrusion to a vulnerability in Metabase, and the ShinyHunters extortion group has claimed an attack on Metabase.\n\n---\n\n## Trezor confirms customer data exposure\n\nHardware wallet maker Trezor disclosed on 13 August 2026 that customer data held by one of its shipping providers, ShipMonk, had been accessed by an unauthorised party. ShipMonk informed Trezor on 10 August. Trezor says its own systems were not compromised and its devices are not affected.\n\nThe first notice covered customers in the US, the UK, Sweden, Colombia, Brazil, Italy and Portugal who placed orders between 10 May and 8 August 2026: 11,742 customers had full names, email addresses, phone numbers and shipping addresses exposed, and 1,947 had their name, city and email address exposed. Trezor later clarified that the partial-exposure group includes older orders.\n\nOn 4 September 2026 Trezor updated its notice. ShipMonk had told it on 2 September that the breach also contained order data from an earlier period of cooperation, November 2019 to August 2021, despite written assurances that this data had been removed. That data affects roughly 67,000 more US customers, with name, email address, phone number, shipping address and order number exposed. Across both notices, that is more than 80,000 customers. Trezor says all affected customers have been emailed from help@trezor.io and warns that the data could be used for phishing emails, calls and letters.\n\n## The ShipMonk and Metabase connection\n\nTrezor has not said how ShipMonk was breached. In breach notification emails reviewed by BleepingComputer, ShipMonk told its customers that attackers had exploited a vulnerability in Metabase, the third-party analytics platform, and that Metabase informed it of this on 6 August 2026. ShipMonk said Metabase had since patched the flaw and invalidated active sessions. Metabase has disclosed that attackers exploited a critical SQL injection zero-day to breach customer instances, and SecurityWeek reports that this is likely the flaw involved.\n\n## ShinyHunters' claim\n\nThe ShinyHunters extortion group has claimed responsibility for an attack on Metabase and has leaked data that it says was stolen from the analytics provider, according to SecurityWeek. BleepingComputer reports that ShipMonk has also received extortion emails from ShinyHunters. These are the group's claims; Trezor has not attributed the breach to any group.\n\n## Key points\n\n- ShipMonk told Trezor on 10 August 2026 that customer data in its systems had been accessed.\n- The first notice covered 11,742 customers with full exposure and 1,947 with partial exposure.\n- On 4 September Trezor added roughly 67,000 US customers whose 2019 to 2021 order data ShipMonk still held, bringing the total above 80,000.\n- ShipMonk attributed the breach to a vulnerability in Metabase; ShinyHunters has claimed an attack on Metabase.\n- Trezor says its own systems and devices were not compromised, but affected customers face a higher risk of phishing.\n\n## Further reading & sources\n\n- [Recent customer data exposed in shipping provider incident](https:\u002F\u002Ftrezor.io\u002Fblog\u002Fnews\u002Frecent-customer-data-exposed-in-shipping-provider-incident) (Trezor)\n- [14,000 Trezor Customers Impacted by Data Breach at ShipMonk](https:\u002F\u002Fwww.securityweek.com\u002F14000-trezor-customers-impacted-by-data-breach-at-shipmonk) (SecurityWeek)\n- [Trezor discloses data breach affecting nearly 14,000 customers](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ftrezor-discloses-data-breach-affecting-nearly-14-000-customers\u002F) (BleepingComputer)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers.png?v=f8ae5b52ce",{"actors":18,"targets":25,"industries":34,"technologies":38},[19],{"url":20,"name":21,"slug":21,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fshinyhunters","shinyhunters","ransomware","Russia",null,[26,30,32],{"name":27,"sector":28,"status":29,"geography":24},"RingCentral","Technology","confirmed",{"name":13,"sector":31,"status":29,"geography":24},"shipping provider",{"name":12,"sector":33,"status":29,"geography":24},"Hardware crypto wallet provider",[35],{"url":36,"name":28,"slug":37},"\u002Findustries\u002Ftechnology","technology",[39,41,42],{"vendor":27,"product":40},"unified communications and contact center solutions",{"vendor":14,"product":14},{"vendor":27,"product":43},"cloud-based collaboration and communication platform","breach","2026-08-18T17:57:49.084977+00:00","2026-10-16T12:29:27.822249+00:00",{"articles":48},[49,60,71,84],{"slug":50,"title":51,"summary":52,"tags":53,"hero_image_url":58,"story_type":44,"created_at":59},"exposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities","Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities","CRM provider Beacon attributes a breach impacting around 1,500 UK charities to a compromised AWS access key that was likely exposed during software development, leading to the exfiltration of supporter personal data.",[54,10,55,56,57],"AWS","Charities","Beacon CRM","Credential Exposure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fexposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities.png?v=ec1f5046ce","2026-08-18T14:16:09.055717+00:00",{"slug":61,"title":62,"summary":63,"tags":64,"hero_image_url":69,"story_type":44,"created_at":70},"france-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims","France's DGFiP Confirms Breach After Hacker ZeroBytes Claims 600,000 Victims","French authorities are investigating a breach of the Directorate General of Public Finances (DGFiP) after hacker ZeroBytes claimed to have stolen data on over 600,000 individuals and businesses.",[65,66,67,10,68],"France","DGFiP","ZeroBytes","Government Security","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrance-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims.png?v=fc9efd493d","2026-08-18T08:44:35.455344+00:00",{"slug":72,"title":73,"summary":74,"tags":75,"hero_image_url":81,"story_type":82,"created_at":83},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA","Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.",[11,76,77,78,79,80],"Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","threat_actor_activity","2026-09-05T07:16:15.004025+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":95,"story_type":82,"created_at":96},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[89,90,91,92,93,94],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00"]