Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.
Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.
- ShipMonk breach exposed names, emails, phone numbers, addresses, and order numbers for 67,000 US customers.
- Data covered November 2019-August 2021 despite repeated written assurances of deletion; total disclosed exposure now exceeds 80,000 customers.
- Breach reportedly by ShinyHunters, starting with Metabase zero-day SQL injection CVE-2026-72898 (CVSS 10.0).
- Trezor warns of scam emails, fraudulent calls, and impersonation risk; hardware wallet security unaffected.
- CVEs
- CVE-2026-72898
- Products
- Metabase
- Threat actors
- ShinyHunters
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-72898 | Unauthenticated SQL Injection in Metabase Grants Admin Access | 10.0 | 99% | KEVPoC ×3 | KEV |
From the original article
2 min read at thehackernews.com
Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U. S. have been impacted in a breach at its shipping provider ShipMonk.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.