Trezor Data Breach: Nearly 14,000 Customers Affected by a Hack of Its Logistics Partner

Trezor, the company behind the hardware wallets for cryptocurrencies, has disclosed a data breach affecting nearly 14,000 customers. The cause was a hack of ShipMonk — a third-party logistics and warehousing provider used by Trezor.

What was leaked

The attackers gained access to order data: full names, shipping addresses, email addresses and phone numbers. According to the company, the details of 11,742 customers were fully exposed (name, email, phone, shipping address) and those of 1,947 customers partially (name, city, email).

The breach affected buyers from the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal who placed orders between May 10 and August 8, 2026. ShipMonk notified Trezor of the unauthorized access on Monday, August 10.

Trezor stresses that the company's own systems were not compromised, its services were not disrupted, and the devices themselves remain secure. Even so, those affected were warned of a likely rise in phishing attacks: scammers may use the stolen data for fake emails, calls and paper letters, impersonating banks, crypto exchanges or even Trezor itself.

A Metabase vulnerability to blame

Trezor did not disclose the exact mechanics of the hack, but the notifications ShipMonk sent to customers state that the attackers exploited a vulnerability in the third-party analytics platform Metabase. According to BleepingComputer, it was a critical SQL-injection zero-day vulnerability: after gaining administrator privileges on the compromised Metabase instances, the attackers stole data. Metabase has already released a fix and invalidated active sessions.

Other companies also fell victim to the same campaign — laptop maker Framework and the form-building service Tally. In addition, ShipMonk received ransom demand emails from the extortion group ShinyHunters.

Not the first time

For Trezor, this is already the second notable breach. In January 2024, attackers gained access to the company's third-party technical support portal; back then, the data of 66,000 users was put at risk. Following that incident, the attackers sent out phishing emails, trying to trick owners into revealing the 24-word wallet recovery seed phrase.

Such attacks on logistics contractors affect more than just the crypto industry: this week Valve notified European buyers of Steam hardware of a data theft following a breach at its shipping partner, CEVA Logistics.

Source: Bleeping Computer