Trezor Breach Expands to 80,689 Users After ShipMonk Data Found

Hardware wallet maker Trezor says a breach at logistics provider ShipMonk exposed contact and order data for roughly 67,000 additional U.S. customers. The Sept. 4 update expands an incident Trezor initially said affected 13,689 people.

The two disclosed groups imply a total of about 80,689 affected customers, though Trezor has not issued a single combined figure. Its use of "another" indicates the new records are separate from the original cohort.

The newly disclosed records cover U.S. orders from November 2019 through August 2021. They include names, email addresses, phone numbers, shipping addresses and order numbers. The data can link an identifiable person and physical location to a hardware-wallet purchase, creating risks beyond a typical email leak.

When Trezor first disclosed the breach on Aug. 13, it counted 11,742 customers with full exposure and 1,947 with partial exposure. The Aug. 13 statement said older order data had already been deleted. The Sept. 4 update reverses that understanding. Trezor said it repeatedly requested and received written assurances from ShipMonk confirming deletion, yet records from 2019 to 2021 remained. The company's published delivery-data policy says customer details should be deleted from both its own and its fulfillment partner's systems after 90 days, with exceptions for ongoing order issues. The assurance letters have not been made public.