An information breach at ShipMonk, one of many logistics corporations that ships {hardware} wallets for Trezor, has uncovered private info belonging to roughly 13,689 prospects. The ShipMonk knowledge breach didn’t contact Trezor’s personal servers or gadgets, the corporate says, but it surely did leak names, e mail addresses, cellphone numbers and, for many victims, dwelling delivery addresses collected between Could 10 and August 8, 2026.
Key takeaways
- ShipMonk informed Trezor on Monday, August 10, 2026, that an unauthorized occasion had accessed programs holding buyer order knowledge.
- About 11,742 prospects had their full names, emails, cellphone numbers and delivery addresses uncovered; one other 1,947 had solely names, cities and emails leaked.
- The breach impacts orders positioned between Could 10 and August 8, 2026, throughout the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.
- Trezor gadgets and inside programs weren’t compromised, and Amazon-fulfilled orders are unaffected.
- Trezor plans to roll out an nameless supply choice within the EU by September 2026 and within the US by the tip of 2026.
ShipMonk Knowledge Breach Exposes Trezor Buyer Knowledge
The difficulty began when ShipMonk, which shops and ships Trezor orders within the US, UK and several other different markets, found unauthorized entry to its programs and handed the information alongside to Trezor on August 10, 2026. Trezor referred to as it “troublesome information” in an announcement posted on X, saying a delivery supplier had suffered a breach that uncovered delicate order knowledge. The corporate has framed this as an incident tied fully to a third-party vendor relatively than a failure of its personal infrastructure.
What Info Was Uncovered
The information taken consists of full names, cellphone numbers, e mail addresses and, for many victims, bodily delivery addresses. That mixture issues as a result of it offers scammers all the things wanted to craft convincing, personalised phishing makes an attempt — not only a generic e mail blast, however messages, calls or letters that reference an actual order and an actual handle.
How Many Prospects Are Affected
In response to Trezor’s personal disclosure, 11,742 prospects had the total set of knowledge uncovered: title, e mail, cellphone quantity and delivery handle. An additional 1,947 prospects skilled a narrower publicity restricted to call, metropolis and e mail, and not using a delivery handle connected. Mixed, that places the whole close to 13,689 individuals, a determine each CoinDesk and The Block rounded to roughly 14,000 of their protection of the incident. Trezor has stated it’s nonetheless verifying whether or not a few of that partial-exposure group consists of older orders that fall outdoors the acknowledged Could-to-August window, and it plans to replace its findings as ShipMonk’s investigation continues.
Trezor Gadgets Stay Safe, However Phishing Danger Rises
Trezor’s {hardware} and inside programs weren’t touched on this breach, and the corporate has been direct about that distinction. “Our programs weren’t compromised, and your Trezor system is safe,” the corporate stated in its discover to prospects. That reassurance issues for anybody nervous about pockets safety particularly, for the reason that leaked knowledge can’t be used to entry funds or bypass device-level cryptography.
What it may be used for is social engineering. This type of Trezor buyer knowledge publicity fingers scammers actual names, cellphone numbers and addresses that may be woven into plausible faux communications.
Why Attackers Might Goal Victims Subsequent
Trezor has warned that affected prospects might now see extra refined phishing makes an attempt by e mail, cellphone or postal mail, with scammers doubtlessly impersonating banks, crypto exchanges or Trezor itself. The corporate’s recommendation is easy: be suspicious of any message urging instant motion, cross-check something uncommon in opposition to Trezor’s official weblog and social channels, and by no means kind a pockets backup phrase into an internet site or share it with anybody.
That is why the phishing threat after breach occasions tends to outlast the preliminary headlines. In response to CoinDesk, individuals whose knowledge is uncovered in breaches like this one stay susceptible for years afterward, since stolen logistics data get resold and repurposed for brand new scams lengthy after the unique incident fades from view. CoinDesk cited previous circumstances the place extortionists used leaked dwelling addresses to demand ransom funds of $700 to $1,000, and even mailed counterfeit {hardware} gadgets on to victims. The outlet additionally famous that managing the authorized, remediation and reputational fallout from a serious customer-data leak has been estimated to value {hardware} companies upward of $33 million in comparable circumstances.
Trezor informed CoinDesk it has no confirmed circumstances but of the uncovered knowledge being revealed, offered or utilized in an energetic rip-off, and it says it isn’t conscious of any hack try linked to the incident to this point. Prospects who purchased by way of Amazon are usually not affected, since these orders run by way of a separate achievement companion.
How Trezor Is Responding
Each buyer whose knowledge was uncovered has already obtained a direct e mail from [email protected] explaining what occurred. Trezor has been clear that silence means security right here: in case you didn’t get that e mail, your info wasn’t a part of this breach.
Notifications and ShipMonk’s Safety Fixes
On its finish, ShipMonk says it has locked down the affected programs and strengthened its safety following the incident, and it’s now working instantly with Trezor to pin down precisely what occurred and which data have been accessed. Trezor’s buyer help crew stays out there for anybody with lingering questions on whether or not they have been affected or what steps to take subsequent.
Knowledge Retention Guidelines and the Push Towards Nameless Supply
One purpose the numbers weren’t larger comes right down to coverage relatively than luck. Trezor enforces a strict 90-day knowledge retention and anonymization rule with its achievement companions, which means ShipMonk is contractually required to delete or anonymize order knowledge three months after supply. That window is designed to cowl the practical lifespan of an order — delivery, returns, refunds — with out holding onto buyer info indefinitely. Due to that coverage, older orders had already been purged from ShipMonk’s programs by the point the breach occurred, which restricted the pool of uncovered data.
Wanting forward, Trezor is creating a extra everlasting repair. The corporate plans to launch nameless supply Trezor prospects can use to obtain {hardware} wallets with out handing over figuring out delivery particulars — counting on a devoted checkout, locker pickup, impartial packaging and generic sender info, with delivery identifiers routinely deleted after supply. That choice is anticipated within the EU by September 2026 and within the US by the tip of 2026. Within the meantime, Trezor is pointing prospects towards interim workarounds: utilizing an nameless e mail handle at checkout, paying with crypto or disposable digital playing cards as a substitute of a private bank card, and utilizing a P.O. Field the place doable, although it notes USPS will nonetheless require identification and can retailer its personal knowledge in that case.
A Sample Rising Throughout {Hardware} Pockets Makers
Trezor has referred to as this the primary breach in its 13-year historical past to show buyer cellphone numbers and delivery addresses particularly, although the corporate has confronted knowledge incidents earlier than. In response to CoinDesk, a third-party help portal tied to Trezor’s guardian firm, Satoshi Labs, was breached in January 2024, affecting round 66,000 individuals, and one other incident in April 2022 compromised knowledge belonging to greater than 106,000 Trezor prospects. In neither case have been system firmware or on-device cryptography breached remotely.
Rival {hardware} pockets maker Ledger has confronted comparable issues. CoinDesk reported that Ledger suffered a breach in January tied to third-party e-commerce companion International-e, on high of a a lot bigger 2020 breach that hit practically 300,000 customers and was later adopted by a phishing marketing campaign involving faux Ledger gadgets mailed to victims. The recurring theme throughout each corporations factors to a broader vulnerability: even when a pockets maker’s personal cryptography stays hermetic, the achievement and logistics companions dealing with bodily delivery stay a mushy goal.
That threat is climbing industry-wide. CoinDesk cited cybersecurity agency SentinelOne’s estimate that international knowledge breaches are up 17% in contrast with 2025, averaging roughly 2,090 assaults worldwide each week, with breach exercise rising round 3% month over month since January. Individually, CoinDesk famous that crypto holders face rising bodily hazard tied to leaked private knowledge, pointing to Certik figures exhibiting in-person coercion assaults totaled $124 million within the first half of this yr alone — although not all of these circumstances hint again to a particular knowledge breach.
FAQ
What’s ShipMonk and the way did they receive my info?
ShipMonk serves because the logistics supplier liable for warehousing and dispatching Trezor shipments. So as to full parcel supply, the corporate requires buyer identification, location particulars, contact quantity and email correspondence handle — these particulars are retained solely for achievement functions.
What particular knowledge was uncovered within the breach?
Uncovered knowledge consists of prospects’ full names, cellphone numbers, e mail addresses and delivery addresses for the bigger group of victims. A smaller group had solely their title, metropolis and e mail handle uncovered, and not using a delivery handle.
How can I do know if I used to be affected by this breach?
If you happen to obtained an e mail from [email protected] concerning the safety incident, your knowledge was a part of the publicity. If no such e mail arrived, Trezor says you weren’t affected.
What ought to I do if my knowledge was uncovered?
Keep alert for phishing makes an attempt by e mail, cellphone or mail, confirm any suspicious communication in opposition to Trezor’s official channels, and by no means enter or share a pockets backup phrase with anybody, on-line or in any other case.
Article produced with the help of synthetic intelligence and reviewed by the editorial crew.