ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

ShipMonk

2 mentions in 7 days · 6 in 30 days · 6 total · first seen · last

Search everything

Timeline

Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider

Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.

Trezor confirmed that a breach at Brevo, its marketing email provider, exposed customer contact data and let hackers send roughly 347,000 phishing emails claiming a fake 'STM32 Entropy Vulnerability' and asking victims for their wallet backup password. Brevo said attackers accessed 138 accounts by abusing overly broad, improperly scoped access privileges. Trezor was also hit weeks earlier by a breach at shipping partner ShipMonk that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 wallet buyers. Trezor stated its own products, wallets, and account systems were unaffected and warned customers to expect further phishing attempts.

TechCrunch · Securityupdated · 4d agofirst · 4d agoData breach in the wild 6 sources1

Trezor: 347,000 users targeted in phishing attacks after Brevo breach

Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.

Threat actors who breached Trezor's third-party email provider Brevo on September 9, 2026 sent fake 'critical security alert' emails from [email protected] to 347,000 opted-in newsletter subscribers, claiming an STM32 microcontroller vulnerability exposed wallet seeds. The emails linked to a malicious app that asked users to enter their wallet backup; 2,500 users clicked before Trezor disabled the phishing domain within 20 minutes. Trezor also disclosed that a prior breach via logistics provider ShipMonk, exploited through a critical Metabase SQL injection zero-day, affected 81,000 customers and drew extortion emails from the ShinyHunters gang.

BleepingComputerupdated · 4d agofirst · 4d agoPhishing & fraud in the wild 6 sources1

Trezor Supply Chain Breach Now Impacts 81,000 Customers

Trezor says a breach at shipping partner ShipMonk exposed data of 81,000 customers, 67,000 more than first reported, including orders back to 2019.

Trezor's September 4 update revealed that stolen ShipMonk data also included order data from November 2019 to August 2021, expanding the incident beyond the May 10 to August 8, 2026 window disclosed on August 13, and raising affected customers to 81,000, a 479% increase over the original estimate. Exposed fields include names, emails, phone numbers, shipping addresses, and order numbers; no wallet credentials or recovery seed data were reported stolen. Trezor blamed ShipMonk for retaining data despite repeated written deletion assurances, is considering legal action, and warned customers of heightened phishing, scam calls, and physical security risks.

Infosecurity Magazine · 7d agoData breach1

Trezor data breach impact now reaches 81,000 customers

Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.

Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.

BleepingComputer · 8d agoData breach in the wild

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 9d agoPhishing & fraud in the wild1

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.

Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.

The Hacker News · 10d agoData breach in the wildCVE-2026-72898

Related CVEs

  • CVE-2026-7289810.094%
    Unauthenticated SQL Injection in Metabase Grants Admin Access
    CVE-2026-72898 is a critical SQL injection flaw (CWE-89, CVSS 4.0 score of 10) in Metabase, a widely used open-source business intelligence platform. A remote, unauthenticated attacker can send crafted input to the '/reset_password' database endpoint to inject arbitrary SQL into the underlying database. Successful exploitation grants the attacker administrator access to the connected Metabase instance, with confidentiality, integrity, and availability impacts rated high in the CVSS 4.0 vector. Any organization running an affected Metabase instance, particularly one exposed to the internet, is at risk. The flaw is a zero-day being exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11, and carries a 94.2% EPSS probability of exploitation within 30 days (100th percentile).
    · Metabase KEV PoC large

Appears with

organization Trezor 5vendor ShipMonk 4victim Trezor 4vendor Trezor 4product Metabase 3vendor Metabase 3threat actor ShinyHunters 3victim Trezor customers 2organization Brevo 2victim ShipMonk 2vendor Brevo 2product Liquid Network 1organization Framework 1product JetBrains Cadence 1organization Conseil Supérieur du Notariat 1organization ANSSI 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.