Trezor has expanded its disclosure of a ShipMonk data breach after learning that older U.S. customer order records were still held by the shipping provider despite earlier deletion assurances.
The hardware wallet maker said in a September 4 update that the incident now affects another approximately 67,000 U.S. customers whose orders were placed between November 2019 and August 2021. The newly disclosed exposure includes names, email addresses, phone numbers, shipping addresses and order numbers, according to Trezor's official update.
The company said Trezor systems, products and services were not compromised. The risk is different: leaked delivery and contact records can make phishing, fraudulent calls, scam letters and potential physical-security targeting more credible.
Key Findings
- Trezor said the ShipMonk breach was larger than previously stated and included historical order data from November 2019 to August 2021.
- The September 4 update added approximately 67,000 U.S. customers with full exposure: name, email, phone number, shipping address and order number.
- The original August disclosure covered 11,742 customers with full exposure and 1,947 customers with partial exposure.
- Trezor says its own systems and devices were not compromised, and that affected customers have been emailed directly.
- The main risk is not private-key theft. It is targeted phishing, impersonation and the broader privacy risk created when a wallet purchase can be tied to a person and address.
What Happened
Trezor first disclosed the ShipMonk incident on August 13, saying one of its shipping providers had experienced unauthorized access to systems containing customer order data. At the time, the company said the breach affected 11,742 customers with full exposure and 1,947 customers with partial exposure.
The story changed on September 4. Trezor said it was informed on September 2 that the breach was larger than previously stated and that ShipMonk also retained order data from an earlier cooperation period between November 2019 and August 2021.
Trezor said it had repeatedly requested and received written assurances that the data had been deleted in line with its contract, data policy and prior communications. The company said it was disappointed that the data remained in ShipMonk systems.
What Data Was Exposed?
The September update says the newly affected group includes another approximately 67,000 U.S. customers with full exposure. Trezor lists the exposed fields as name, email, phone number, shipping address and order number.
The original August disclosure said 11,742 customers had full exposure, while 1,947 had partial exposure involving name, city and email address. Trezor later clarified that some of the partial-exposure records could include older orders.
CryptoSlate reported that the expanded disclosure implies roughly 80,689 affected customers when the August and September figures are read together, while noting that Trezor has not published a single combined dataset or row-level overlap check. That distinction matters because TCP should not present an inferred total as a confirmed official number.
Why the Risk Is Not About Private Keys
This incident does not appear to be a wallet compromise. Trezor says its systems were not breached, its products and services were not affected and Trezor devices remain secure.
The security issue sits around the wallet rather than inside it. A hardware wallet can keep private keys offline, but the purchase and delivery process can still create a data trail: name, address, phone number, email address and order details.
That is why the incident is important for self-custody users. Protecting a recovery phrase is essential, but it does not remove the privacy and social-engineering risks created by exposed logistics records.
How Trezor Says It Is Responding
Trezor says it has emailed all affected customers directly. Its guidance is simple: if a customer did not receive an incident email from help@trezor.io, Trezor says they are not affected by this breach.
The company also says it is in direct contact with ShipMonk to establish what happened and which data was accessed. In the August disclosure, Trezor said ShipMonk had secured the affected systems and hardened its security after the incident.
Trezor has also pointed to privacy-focused ordering steps, including anonymous email use, more private payment choices where suitable and P.O. Box options where available. It says an anonymous delivery option is planned for the EU and the U.S., with timing previously described as September 2026 for the EU and the end of 2026 for the U.S.
What Affected Customers Should Watch
The clearest practical risk is targeted impersonation. Trezor warned that exposed information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected people to physical-security risks.
Customers should be especially cautious of any message that creates urgency, asks for personal information or directs them to enter a wallet backup online. Trezor's standing warning remains central: never enter a wallet backup on a website and never share it with anyone.
This is also why breach notifications should be treated carefully. A real incident can create space for fake follow-up messages. The safest habit is to verify important instructions through Trezor's official blog and official channels rather than through links in unsolicited messages.
What Remains Unclear
The public record does not yet answer every question. Trezor has not published the written deletion assurances it says it received from ShipMonk. It has also not published a detailed overlap analysis between the original August group and the newly disclosed September group.
CoinDesk reported in August that Trezor said it had no confirmed cases of the exposed data being published, shared, offered for sale or linked to a scam or hack attempt at that time. The September update warns about risk but does not identify a confirmed downstream attack caused by the newly disclosed records.
That means the correct editorial framing is not that harm has already occurred at scale. The verified point is that a larger group of customers now faces elevated risk because sensitive contact and shipping data was exposed.
Why It Matters for Self-Custody
Self-custody is often discussed as a private-key problem: keep the seed phrase offline, use a hardware wallet, avoid malicious websites and do not sign transactions blindly. Those rules still matter.
But the Trezor-ShipMonk incident shows another layer of risk. A user can secure the wallet itself while still leaving a trail through checkout, delivery, support, email and third-party fulfillment systems.
For hardware wallet companies, the lesson is operational: vendor retention policies need verification, not only contractual language. For users, the lesson is practical: privacy around purchase and delivery can be part of wallet security, especially for anyone holding meaningful value.
This is not investment advice. It is a reminder that crypto security is broader than devices alone. Private keys may be offline, but personal data can still become an attack surface.
Responses (0 )