Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk.
The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets.
"Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications," Trezor said. "We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems."
The exposure is in addition to 13,689 customers the company disclosed last month as having had their data either fully or partially exposed. The breach, it noted at the time, was limited during its 90-day data storage policy.
Trezor said ShipMonk informed the hardware wallet maker of a breach on August 10, 2026, following unauthorized access to their systems. Subsequently, it revealed that the 1,947 customers whose exposure was limited only to names, cities, and email addresses (excluding the shipping addresses) may include older orders.
"After 90 days we delete or anonymize all customer data related to a purchase on our Trezor eShop," the company said. "We chose 90 days because it is the shortest window that still covers the whole life of an order — delivery, returns, and any refund or replacement. After that we have no reason to keep your address or phone number."
ShipMonk has yet to acknowledge the incident publicly. The logistics company is said to have secured the affected systems and improved its security after the digital break-in, which involved the zero-day exploitation of CVE-2026-72898 (CVSS score: 10.0), a critical SQL injection flaw in Metabase.
According to enterprise blockchain security firm Holborn, the ShinyHunters extortion gang is said to be behind the breach. Trezor said it has notified affected customers directly.
However, it warned users to be on the lookout for social engineering attacks and scams, as bad actors can exploit the leaked information to send phishing emails or letters, make fake phone calls, and even impersonate the company in email communications to persuade targets into taking unintended actions.
"The leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks," Trezor said.
Holborn said the software supply chain attack highlights the need for organizations to have complete visibility into their third-party risk exposure in order to help manage their overall security posture.
"The Trezor breach was the result of a supply chain attack beginning with a zero-day vulnerability," it said. "By finding and exploiting the SQL injection flaw in Metabase, the attackers were able to exploit several of its customers, stealing sensitive data and extorting the organization."
"In Trezor's case, this meant the exposure of customer order details that were stored in a Metabase instance by ShipMonk."
