Trezor Shipping-Provider Breach Exposes Data of 13,689 Customers

Exposed Customers

13,689

Total number of customers affected by the data breach.

Full Data Exposed

11,742

Number of customers whose full name, email address, phone number, and shipping address were exposed.

Partial Data Exposed

1,947

Number of customers whose name, city, and email address were exposed.

§ 01 Executive Snapshot

What: A data breach at Trezor's shipping provider ShipMonk exposed personal data of 13,689 customers.
Who: Trezor and its third-party shipping provider ShipMonk.
Why it matters: The breach poses significant risks of targeted phishing and physical security threats to affected customers.

11,742 customers had their full name, email address, phone number, and shipping address exposed.
1,947 customers had their name, city, and email address exposed.
The breach affected orders delivered between May 10 and August 8 to customers in multiple countries including the U.S., U.K., and Brazil.

Trezor has had a 90-day data-retention policy that limited the exposure of customer data post-delivery, but this breach is notable as it is the first to expose customer phone numbers and shipping addresses since the company was founded in 2013.
Previous incidents affecting hardware wallet companies, such as Ledger, highlight a recurring issue of order-data exposure without compromising the wallets themselves.

Immediate implications include increased risks of sophisticated phishing attacks targeting affected customers, leveraging the exposed personal data.
Long-term, Trezor plans to introduce an “Anonymous Delivery” option to enhance customer privacy and security by 2026, which could mitigate future risks.

Potential risks include ongoing phishing attempts and physical security threats to customers as a result of the exposed data.
Dependencies on third-party shipping providers like ShipMonk can pose execution roadblocks in maintaining data security.

Trezor aims to implement an “Anonymous Delivery” option in the EU by September 2026 and in the U.S. by the end of 2026.
Continued investigation outcomes from Trezor and ShipMonk regarding the breach will signal the effectiveness of their security measures and data protection strategies.

§ 07

What data was exposed in the Trezor breach?

The breach exposed personal data of 13,689 customers, including full names, email addresses, phone numbers, and shipping addresses.

Why is the Trezor data breach significant?

The breach poses significant risks of targeted phishing and physical security threats to affected customers.

Who was responsible for the data breach affecting Trezor customers?

The breach occurred at Trezor's third-party shipping provider, ShipMonk.

When did the data breach at Trezor's shipping provider take place?

The breach affected orders delivered between May 10 and August 8.