Fazlur Rahman
Published September 10, 2026 - Prague, Czech Republic. Trezor, the hardware cryptocurrency wallet manufacturer, confirmed on September 4, 2026 that a data breach at its logistics partner ShipMonk is substantially larger than first reported, with about 67,000 additional U.S. customers exposed, bringing the total impact above 80,000 (Cybersecurity News, September 4, 2026). Attackers exploited a critical SQL injection zero-day in the Metabase analytics platform used by ShipMonk. Trezor devices themselves remain secure, and no wallet backups or recovery seeds were exposed. The risk to affected customers is targeted phishing and social engineering using the breached contact data, not direct theft of cryptocurrency.
(per the Cybersecurity News, September 4 2026 reference.)Breach data last verified September 10, 2026 from Cybersecurity News (September 4, 2026) and the official Trezor support portal (trezor.io/support).
The Trezor ShipMonk breach expanded on September 4, 2026 with 67,000 additional U.S. customers exposed, bringing the total impact above 80,000 customers. Attackers exploited a Metabase SQL injection zero-day on ShipMonk's unpatched instance. Trezor devices, wallet backups, and recovery seeds were NOT compromised. Affected customers should be alert to phishing campaigns using the breached contact data, never share recovery seeds, and verify all support interactions through the official Trezor channels. Trezor is preparing an Anonymous Delivery option to mitigate future exposure.
What Was Exposed
The first disclosure on August 13, 2026 covered 11,742 customers whose names, emails, phone numbers and shipping addresses were fully exposed, plus 1,947 with partial exposure of name, city and email, totaling about 13,689 people. Those records were linked to orders in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal between May 10 and August 8, 2026. An August 14 update already admitted that some partial-exposure records included older orders.
The September 4 update added 67,000 additional U.S. customers from a prior ShipMonk partnership between November 2019 and August 2021. The newly acknowledged U.S. files include name, email, phone number, shipping address, and order number. The total impact is now above 80,000 customers globally.
What Was Not Exposed
Trezor's own systems were not breached, its devices remain secure, and wallet backups were not leaked. Parcel contents were not exposed. No recovery seeds, PINs, passphrases, or any on-device cryptographic material were exposed. The breach was limited to order-handling data held by ShipMonk - the logistics company that ships Trezor devices from warehouse to customer.
