Crypto▼ Bearish
Data for 13,689 Trezor Clients Exposed in Subcontractor Leak
A shipping subcontractor exposed emails and phone numbers for 11,742 Trezor customers. No recovery phrases leaked; the follow-up is targeted phishing.
Continue with
Trezor notified 13,689 customers that a logistics subcontractor leaked their personal data. The exposed records for 11,742 of those clients include names, delivery addresses, email addresses, and phone numbers. Another 1,947 had only their name and email address in the compromised files.
The affected orders were placed in the 90 days before Aug. 8. Customers in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal are among those exposed, the wallet maker said. Trezor is investigating the incident with the provider and has started contacting each affected client directly. The direct outreach gives those customers a reference point for any incoming message that claims to come from the company.
Recovery phrases and private keys were not among the leaked records. Trezor said the devices themselves remain secure. Personal details alone cannot move funds out of a hardware wallet. The recovery phrase can.
Hardware wallets exist to keep recovery phrases and private keys off internet-connected devices, and that promise still holds after this leak. Trezor had already warned customers about fake support emails before this incident. A recovery phrase is the master key to the wallet. Whoever holds it can rebuild the private keys and move the coins without touching the original device. Phishing is the tool built to extract it.
Fraudsters chose this group deliberately. They already hold crypto, and they have paid for a specialized device to protect it. An email address alone is enough to send a fake Trezor message. Add a name and a phone number, and the message turns personal. The delivery address confirms where the wallet went.
The smaller group of 1,947 clients had no phone number or address in the leak. They still had a name and an email address exposed. A name and an email are enough to build a personalized phishing email.