Breach at shipping provider ShipMonk exposes data of up to 80,689 Trezor customers

On 13 August 2026 Trezor disclosed that its shipping and fulfilment provider, ShipMonk, had informed it on 10 August of unauthorised access to systems containing customer data. Trezor said 11,742 customers had their full names, phone numbers, email addresses and shipping addresses exposed and 1,947 more had their name, city and email exposed. BleepingComputer reports the affected orders were placed between 10 May and 8 August 2026 by customers in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.

According to breach notification emails seen by BleepingComputer, ShipMonk said a vendor, Metabase, told it on 6 August that an unauthorised party had exploited a vulnerability in Metabase’s software to access data related to ShipMonk’s account and customers. Trezor did not say how ShipMonk’s systems were breached.

On 4 September Trezor updated its post: ShipMonk had told it on 2 September that about 67,000 more US customers were affected, with names, emails, phone numbers, shipping addresses and order numbers from orders placed between November 2019 and August 2021, for a total of 80,689 in Trezor’s FAQ. Trezor told The Block it had received written assurances that this data had been deleted. Trezor states its own systems were not compromised and that devices, private keys and wallet backups were not affected.

What Trezor advises:

• Be suspicious of any message that pushes for immediate action or asks for personal information; expect phishing by email, phone or post.
• Never enter your wallet backup on a website or share it with anyone.