The breach hit 11,742 prospects whose names, electronic mail addresses, telephone numbers, and transport addresses have been all uncovered, plus 1,947 whose names, cities, and electronic mail addresses have been taken.
Order numbers have been included. Trezor stated the data got here from orders acquired between Might 10 and August 8, 2026, and named america, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal because the affected markets.
“Our techniques weren’t compromised, and your Trezor gadget is safe,” the corporate acknowledged, including that {hardware} wallets, personal keys, and pockets backups weren’t affected.
A 90-day information storage coverage, which Trezor stated it negotiated into its achievement companions’ phrases as effectively, saved older orders out of the uncovered set, however each affected buyer was contacted individually by electronic mail.
Phishing Warning Follows Handle Leak
Trezor instructed prospects to deal with any communication that calls for speedy motion or requests private data as “suspicious,” to test claims in opposition to official channels, and to by no means enter a pockets backup on a web site or share it with anybody.
Its disclosure stated affected prospects “may expertise a rise in phishing makes an attempt.” But it surely appears customers discovered that assertion cynical. “Phishing?? They’ve bodily addresses, you imbeciles,” wrote an X person posting as Chikun, in a reply that collected about 159 likes throughout the hour. One other reply known as the publicity “irl phishing.”
We now have some troublesome information to share. Sadly, certainly one of our transport suppliers has skilled a knowledge breach that uncovered delicate order information. This impacts new prospects within the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who acquired an order throughout the 90 days…
— Trezor (@Trezor) August 13, 2026
The phishing threat nonetheless tracks what adopted a comparable incident at a rival. CryptoPotato reported that scammers used order information leaked from Ledger’s e-commerce accomplice World-e to ship phishing emails claiming Ledger and Trezor had merged, pushing recipients to enter 24-word restoration phrases on a faux website.
But One other Trezor Incident
Trezor stated it’s investigating and can publish updates on its weblog. The corporate additionally talked about constructing an Nameless Supply choice, with impartial packaging, generic sender particulars, and automated deletion of transport identifiers.
Not a straightforward time for being a Trezor buyer, as they’ve been reached by way of distributors twice earlier than. Attackers despatched phishing emails by way of a Trezor mailing record compromised at MailChimp in 2022, pointing customers to lookalike obtain domains constructed to steal seed phrases.
Two years later, a breach of a third-party assist ticketing portal uncovered names and electronic mail addresses for roughly 66,000 customers who had contacted Trezor Help since December 2021. Each of these uncovered contact particulars, however this one uncovered dwelling addresses throughout a number of nations.
The submit Trezor Supplier ShipMonk Breach Uncovered Order Knowledge for 13,689 {Hardware} Pockets Prospects appeared first on CryptoPotato.