Trezor Reports Additional Data Exposure Following ShipMonk Breach

Trezor confirmed that records dating from November 2019 through August 2021 were compromised in a breach at its fulfillment provider, ShipMonk. This update follows an initial disclosure on August 13 regarding a smaller group of customers. The newly identified data includes names, email addresses, phone numbers, shipping addresses, and order numbers.

The exposure occurred despite written assurances from ShipMonk that such historical records had been deleted. Trezor maintains a policy requiring the removal of customer data from its own and its partners' systems within 90 days of an order, barring ongoing issues. The retention of these files contradicts the provider's previous confirmations to the wallet manufacturer.

BleepingComputer reported that the unauthorized access originated from a vulnerability in the analytics platform Metabase. This security flaw allowed for the potential download of bulk tables, which included the retained historical customer data.

Trezor stated that its internal systems, products, and services remain unaffected, and no recovery seeds, private keys, or wallet funds were compromised. The company emphasized that its hardware devices remain secure.

The primary risk identified by Trezor involves the potential for phishing attempts, fraudulent communications, and physical security threats, as the leaked data links specific individuals to hardware wallet purchases. While the company has not confirmed any downstream attacks resulting from this specific dataset, it has contacted all affected customers directly. Trezor continues to advise users never to share wallet backups or enter them into websites.