ShipMonk Breach Exposes Data of 13,689 Trezor Customers

Trezor said affected orders were received between May 10 and Aug. 8 across the U.S., U.K., Sweden, Colombia, Brazil, Italy and Portugal. Every affected customer was emailed directly, and anyone who did not receive a notice was not caught in the breach, the company said. Exposed customers should expect more sophisticated phishing attempts from attackers impersonating Trezor or other financial institutions, the company warned.

Phishing is not the only risk. Physical attacks on crypto holders are rising, and a Ledger co-founder was kidnapped in France. Chainalysis data shows more than $30 million was stolen in violent crypto attacks during the first half of 2026, putting the year on pace to exceed 2025's full-year total of $58 million.

Rival Ledger has faced both risks before. A 2020 breach exposed data on more than 270,000 customers, and names, emails, phone numbers and some home addresses were later posted to a hacking forum. The posted records produced years of phishing calls and physical scam letters demanding seed phrases. In January, Ledger customers were notified of another exposure, this time through e-commerce provider Global-e.

Trezor said the scale of the incident was limited by a 90-day retention policy that it also requires of fulfillment partners, meaning older order data had already been deleted or anonymized. The company also pointed to an Anonymous Delivery option using locker pickup and neutral packaging, with automatic deletion of shipping identifiers. It aims to launch the option in the EU by September 2026 and in the U.S. by year-end.