Trezor Supply Chain Breach Now Impacts 81,000 Customers
Trezor says a breach at shipping partner ShipMonk exposed data of 81,000 customers, 67,000 more than first reported, including orders back to 2019.
Trezor's September 4 update revealed that stolen ShipMonk data also included order data from November 2019 to August 2021, expanding the incident beyond the May 10 to August 8, 2026 window disclosed on August 13, and raising affected customers to 81,000, a 479% increase over the original estimate. Exposed fields include names, emails, phone numbers, shipping addresses, and order numbers; no wallet credentials or recovery seed data were reported stolen. Trezor blamed ShipMonk for retaining data despite repeated written deletion assurances, is considering legal action, and warned customers of heightened phishing, scam calls, and physical security risks.
- Victim count jumped from roughly 14,000 to 81,000 after ShipMonk data from November 2019 to August 2021 was found stolen.
- Exposed data includes names, emails, phone numbers, shipping addresses, and order numbers; no recovery codes reported stolen.
- Trezor says ShipMonk repeatedly provided written deletion assurances that proved false; legal action is under consideration.
- Trezor warns of heightened phishing, scam calls, and physical security risks; accelerating anonymous delivery options.
Full article385 words · extracted from infosecurity-magazine.com · click to collapse
Cryptocurrency wallet manufacturer Trezor has revealed that a breach at a key shipping partner has affected 67,000 more customers than originally thought.
In an update posted on September 4, the hardware specialist said it was informed that the trove stolen from ShipMonk also included order data from the time period November 2019 – August 2021.
When the original breach notification was posted on August 13, the firm claimed that only data from between May 10 and August 8 2026 was involved.
The new victim count represents a 479% increase on the original estimate.
Read more on Trezor: Major Phishing Campaign Targets Trezor Crypto Wallets.
Full details were exposed in the incident, including customer names, emails, phone numbers, shipping addresses and order numbers.
“Be aware of the increased risk of phishing,” the firm warned. “The leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks.”
Trezor customers have been a popular target for threat actors over the years. In 2022, it was forced to clarify that an email sent to customers warning of a major data breach at the firm was a scam designed to trick them into handing over their wallet recovery codes.
A Supply Chain Snafu
Trezor laid the blame for the recent breach firmly at the feet of its logistics partner, claiming that its data minimization policy wasn’t followed.
“Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,” it wrote in a post on X (formerly Twitter). “We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.”
Trezor said it was still deciding whether to take legal action against the firm.
“We are in direct contact with ShipMonk to establish exactly what happened and which data was reached. ShipMonk has secured the affected systems and hardened its security after the incident,” it continued.
“We are also speeding up work on anonymous delivery in our shop, so that in the future less personal data has to leave our systems at all, and in the meantime you can already keep what you share to a minimum by using a PO box, parcel locker, or pickup point.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/trezor-supply-chain-breach-impacts/