Trezor Says Ship Monk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Summary: Trezor disclosed that 67,000 U.S. customers had names, email addresses, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021 exposed in a breach at its shipping provider ShipMonk, which notified Trezor of unauthorized access on August 10, 2026. The exposure adds to 13,689 customers disclosed last month, and Trezor said it had repeatedly received written assurance from ShipMonk that the data was deleted, though ShipMonk has not acknowledged the incident publicly.
Key Takeaway: Trezor held written confirmation that ShipMonk deleted the data, and the data was still there to be stolen - so a vendor's contractual assurance is not evidence of deletion. The leaked names, addresses, and phone numbers are the raw material for phishing, fraudulent calls, and physical security risks against hardware wallet owners.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Mentions
- CVE-2026-72898
- Related
- CVE-2026-72898: Metabase SQL Injection Vulnerability Known Exploited Vulnerabilities · Aug 11, 2026At The Edge Clear: October 5 – 13, 2026 Cyber Risks ·TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026