Trezor says ShipMonk breach exposed data from another 67,000 customers

Trezor initially disclosed the incident on Aug. 13, identifying nearly 14,000 affected customers. The company said ShipMonk informed it on Sept. 2 that the breach was larger than first reported, despite earlier written assurances that the order data had been deleted under contractual policies.

The key distinction is customer exposure versus wallet compromise. Trezor said its own systems were not breached and that its hardware wallets remain secure. The exposed information can still create phishing, impersonation and physical-safety risks for people known to own a crypto device.

Why old shipping data still matters

The company said it has emailed customers included in the latest disclosure and warned them to watch for scam emails, fraudulent calls and letters. A shipping address paired with a hardware-wallet purchase can help an attacker target a person years after the original order.

Trezor said it repeatedly asked ShipMonk to delete the data during their relationship. The episode shows why deletion promises from fulfillment partners need verification, retention controls and incident reporting that can be audited rather than accepted at face value.

The practical response is treat every outreach as untrusted. Customers should not enter recovery phrases, approve wallet transactions or move funds because of a message claiming to be from Trezor. They should verify support addresses independently and consider whether exposed home details require additional precautions.

The incident also adds to a history of crypto-hardware customer leaks, including the 2020 Ledger breach that exposed information on more than 270,000 customers. The lesson is narrow but durable: a secure device cannot prevent harm when third-party data identifies who owns it. Trezor's systems may be intact, but the privacy and targeting consequences remain active for the people in the records.