Hardware wallet manufacturer Trezor announced that a data breach at its shipping partner, ShipMonk, has impacted an additional 67 000 US customers. The exposed information includes names, email addresses, phone numbers, shipping details, and order history for users who placed orders between November 2019 and August 2021.
Trezor stated that its own internal systems remain secure. The company claims the breach occurred because ShipMonk failed to delete customer data as previously promised in writing. The exposed information poses a risk of phishing and social engineering attacks, where bad actors may attempt to impersonate Trezor to steal wallet seed phrases.
This incident follows an initial estimate in August that 14 000 users were affected. Previously, in January 2024, Trezor reported that 66 000 users were at risk of phishing due to interactions with the company's support team since December 2021. Security firm Hacken reports that phishing and social engineering caused $306 million in losses during the first quarter of the year.