Trezor announced that an additional 67,000 customers in the U.S. were affected by a data breach at its shipping partner, ShipMonk. The compromised records include customer names, phone numbers, home addresses, and order numbers for purchases made between November 2019 and August 2021. The total number of affected users has increased from 13,689 to approximately 80,700.
The breach originated from a SQL injection vulnerability in the Metabase analytics tool, which allowed unauthorized access to connected databases. ShipMonk reportedly received extortion demands from a group identified as ShinyHunters. Trezor stated that it had previously received written confirmation from ShipMonk that the data in question had been deleted in accordance with their contract.
Trezor confirmed that its internal systems, hardware wallets, private keys, and backups remain secure. However, the company warned users about potential physical security risks and phishing attempts. To mitigate future exposure, Trezor is accelerating the implementation of anonymous delivery options, including locker pickups and neutral packaging, to eliminate the need for sharing home addresses.