Data of 13,689 Trezor customers have been leaked after an unauthorized access to ShipMonk, one of the company’s current shipping providers.
Trezor concluded that internal systems, wallets, and other devices had not been compromised. However, they acknowledged that, with the shipping records, some scammers might target owners of its wallets for phishing attacks.
What Trezor customer data was exposed?
ShipMonk informed Trezor of the incident on August 10, after which Trezor released a public statement about the breach on August 13. They also stated that the investigation is still ongoing.
The information exposed includes names, email addresses, phone numbers, and shipping addresses for 11,742 customers, and another 1,947 customers had their names, cities, and email addresses stolen.
The affected orders were delivered in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal from May 10 to August 8.
According to Trezor, “the breach is limited due to Trezor’s strict 90-day data storage policy.”
The company also stated that the breach did not extend to user wallet backups, private keys, or payment data, and it noted that there was no interruption to its service or products.
But the risk instead comes from criminals knowing who owns a hardware wallet and, in some cases, where that person lives. With this information, they could pretend to be from Trezor, a cryptocurrency exchange, or financial institution via email, phone, or correspondence.
Another hardware-wallet security warning
What makes this interesting is that the incident follows the recent Coldcard exploit, although the two cases are different when analyzed.
Coldcard suffered from a flaw that caused wallet seeds on certain devices to be created incorrectly, and according to TRM Labs, by August 5, 1,816 BTC, which is around $116 million, had been stolen by attackers.
The Trezor breach did not expose wallet keys or directly compromise customer funds. What it was was a security failure that occurred at a third-party shipping provider that exposed customer identities, leaving phishing and impersonation as the most obvious dangers.
Trezors says affected customers have been contacted by, and that users have been warned to distrust unsolicited communications.
Final Summary
- ShipMonk’s breach left personal data from 13,689 Trezor users, including thousands of delivery addresses, accessible to third parties.
- Trezor crypto wallets are secure, but the breach has exposed enough information to carry out targeted phishing and impersonation attacks.
