Key Takeaways
- • Trezor disclosed a data breach affecting 13,689 customers caused by unauthorized access to ShipMonk, its third-party fulfillment and logistics partner, exposing shipping addresses and personal information across seven countries.
- • Affected customers span the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal—primarily those who received Trezor hardware wallet devices within a specific timeframe in May and subsequent months.
- • Attackers leveraged stolen customer data to conduct phishing campaigns, creating a secondary security risk for crypto asset holders who are now targets for social engineering attacks and potential account compromise.
- • The breach underscores supply chain vulnerability in the cryptocurrency hardware wallet sector, where third-party logistics providers access sensitive customer information without equivalent security controls to the primary vendor.
Summary
Trezor, a leading manufacturer of hardware cryptocurrency wallets, disclosed a data breach affecting nearly 14,000 customers following unauthorized access to ShipMonk, its third-party shipping and logistics provider. The breach exposed personal data including names, email addresses, and shipping information for 13,689 customers in seven countries: the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. The affected customers had received Trezor devices during a specific shipment window beginning in May 2026.
The breach originated not from Trezor's infrastructure but from ShipMonk's systems, highlighting a critical vulnerability in cryptocurrency hardware supply chains. The unauthorized access granted attackers direct exposure to customer order data maintained by the fulfillment partner, bypassing Trezor's direct security perimeter. This third-party risk illustrates the challenge that even security-focused companies face when delegating logistics and customer data handling to external vendors.
Compounding the initial data exposure, Trezor confirmed that threat actors subsequently weaponized the stolen information to launch phishing campaigns targeting affected customers. These coordinated attacks attempt to deceive recipients through social engineering, potentially compromising private keys and cryptocurrency holdings. For hardware wallet users—who depend on these devices precisely to isolate private keys from internet-connected systems—phishing attacks represent a meaningful secondary threat vector, as adversaries can now craft highly targeted messages using verified customer details.
The incident carries material risk implications for the affected customer base, which represents institutional and retail crypto asset holders whose identities and purchase history are now exposed in attacker databases. Trezor has advised customers to remain vigilant against unsolicited communications and suspicious links, though the full scope of follow-on attack campaigns remains uncertain. This breach reinforces the importance of supply chain security audits and third-party vendor risk management in the cryptocurrency infrastructure sector.
The breach originated not from Trezor's infrastructure but from ShipMonk's systems, highlighting a critical vulnerability in cryptocurrency hardware supply chains. The unauthorized access granted attackers direct exposure to customer order data maintained by the fulfillment partner, bypassing Trezor's direct security perimeter. This third-party risk illustrates the challenge that even security-focused companies face when delegating logistics and customer data handling to external vendors.
Compounding the initial data exposure, Trezor confirmed that threat actors subsequently weaponized the stolen information to launch phishing campaigns targeting affected customers. These coordinated attacks attempt to deceive recipients through social engineering, potentially compromising private keys and cryptocurrency holdings. For hardware wallet users—who depend on these devices precisely to isolate private keys from internet-connected systems—phishing attacks represent a meaningful secondary threat vector, as adversaries can now craft highly targeted messages using verified customer details.
The incident carries material risk implications for the affected customer base, which represents institutional and retail crypto asset holders whose identities and purchase history are now exposed in attacker databases. Trezor has advised customers to remain vigilant against unsolicited communications and suspicious links, though the full scope of follow-on attack campaigns remains uncertain. This breach reinforces the importance of supply chain security audits and third-party vendor risk management in the cryptocurrency infrastructure sector.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.