Trezor Data Breach Exposes 13,689 Customer Names and Addresses

Trezor disclosed a data breach at ShipMonk, a fulfillment partner, that exposed personal information belonging to 13,689 customers. Orders shipped between May 10 and August 8 were affected. For 11,742 people, the stolen data included full names, phone numbers, email addresses, and shipping addresses. Another 1,947 had names, cities, and emails exposed. The breach spanned customers in seven countries across the United States and Europe.

The unsettling detail is that a hardware wallet purchase can create a physical security trail even when the wallet itself remains technically secure. Trezor said its own systems were not compromised. No device, private key, or wallet backup was affected, separating the incident from a direct wallet-security failure. ShipMonk told the company on Monday that an unauthorized party had accessed systems containing customer information.

Trezor's policy requiring partners to delete or anonymize order data 90 days after delivery limited the breach. Older customer records were no longer available within the compromised environment when the attacker gained access. That retention rule appears to have reduced the exposure substantially.

The company is now warning affected customers to treat unexpected communications with suspicion and never enter a wallet backup online. Trezor said customers who did not receive a notification email are not affected. The exposed information nevertheless gives attackers material that can make phishing attempts more convincing, particularly when names, phone numbers, emails, and home addresses can be combined. The risk is no longer limited to fraudulent links or messages. Personal shipping data can connect cryptocurrency ownership with a real-world location, creating a security problem that extends beyond passwords, seed phrases, and conventional account protections.