Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.
Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.
- ShipMonk breach exposed names, emails, phone numbers, addresses, and order numbers for 67,000 US customers.
- Data covered November 2019-August 2021 despite repeated written assurances of deletion; total disclosed exposure now exceeds 80,000 customers.
- Breach reportedly by ShinyHunters, starting with Metabase zero-day SQL injection CVE-2026-72898 (CVSS 10.0).
- Trezor warns of scam emails, fraudulent calls, and impersonation risk; hardware wallet security unaffected.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-72898 | Unauthenticated SQL Injection in Metabase Grants Admin Access CVE-2026-72898 is a critical SQL injection flaw (CWE-89, CVSS 4.0 score of 10) in Metabase, a widely used open-source business intelligence platform. A remote, unauthenticated attacker can send crafted input to the '/reset_password' database endpoint to inject arbitrary SQL into the underlying database. Successful exploitation grants the attacker administrator access to the connected Metabase instance, with confidentiality, integrity, and availability impacts rated high in the CVSS 4.0 vector. Any organization running an affected Metabase instance, particularly one exposed to the internet, is at risk. The flaw is a zero-day being exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11, and carries a 94.2% EPSS probability of exploitation within 30 days (100th percentile). Do: Upgrade promptly to the fixed Metabase release identified in the vendor's security advisory (no version numbers were provided in the available data), as the flaw is being exploited in the wild and is on CISA's KEV list under BOD 26-04. Until patched, restrict internet access to Metabase and limit reachability of the '/reset_password' endpoint to trusted networks. Hunt for compromise by reviewing access logs for anomalous requests to the reset-password endpoint and checking for unexpected administrator accounts or changed admin credentials. | 10.0 | 94% | KEV PoC |
| large≈10k–50k internet-exposed Metabase instances (tens of thousands) |
Full article523 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 05, 2026Data Breach / Vulnerability
Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk.
The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets.
"Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications," Trezor said. "We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems."
The exposure is in addition to 13,689 customers the company disclosed last month as having had their data either fully or partially exposed. The breach, it noted at the time, was limited during its 90-day data storage policy.
Trezor said ShipMonk informed the hardware wallet maker of a breach on August 10, 2026, following unauthorized access to their systems. Subsequently, it revealed that the 1,947 customers whose exposure was limited only to names, cities, and email addresses (excluding the shipping addresses) may include older orders.
"After 90 days we delete or anonymize all customer data related to a purchase on our Trezor eShop," the company said. "We chose 90 days because it is the shortest window that still covers the whole life of an order — delivery, returns, and any refund or replacement. After that we have no reason to keep your address or phone number."
ShipMonk has yet to acknowledge the incident publicly. The logistics company is said to have secured the affected systems and improved its security after the digital break-in, which involved the zero-day exploitation of CVE-2026-72898 (CVSS score: 10.0), a critical SQL injection flaw in Metabase.
According to enterprise blockchain security firm Holborn, the ShinyHunters extortion gang is said to be behind the breach. Trezor said it has notified affected customers directly.
However, it warned users to be on the lookout for social engineering attacks and scams, as bad actors can exploit the leaked information to send phishing emails or letters, make fake phone calls, and even impersonate the company in email communications to persuade targets into taking unintended actions.
"The leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks," Trezor said.
Holborn said the software supply chain attack highlights the need for organizations to have complete visibility into their third-party risk exposure in order to help manage their overall security posture.
"The Trezor breach was the result of a supply chain attack beginning with a zero-day vulnerability," it said. "By finding and exploiting the SQL injection flaw in Metabase, the attackers were able to exploit several of its customers, stealing sensitive data and extorting the organization."
"In Trezor's case, this meant the exposure of customer order details that were stored in a Metabase instance by ShipMonk."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html