Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Summary

A data breach at logistics vendor ShipMonk exposed personal information belonging to 67,000 U.S. Trezor customers. Trezor confirmed that the incident was caused by a zero-day vulnerability in Metabase and involved customer records that should have been purged under contractual retention policies. While the hardware wallets themselves remain fully secure, affected users face heightened risks of phishing and social engineering.

Key Takeaways

1. Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk.
2. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets.
3. Holborn said the software supply chain attack highlights the need for organizations to have complete visibility into their third-party risk exposure in order to help manage their overall security posture.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 15% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies directly on official disclosures from Trezor and corroborating analysis from blockchain cybersecurity firm Holborn. Technical identifiers like CVE-2026-72898 and CVSS severity metrics are accurately documented. While third-party logistics vendor ShipMonk has not issued a public response, the claims are grounded in verifiable breach notifications.

Bias assessment: Cybersecurity Incident Reporting. The article presents technical reporting focused on data vulnerability, vendor risk, and customer security impacts. It maintains neutral, objective coverage without sensationalism. Direct corporate statements are balanced with technical explanations of the software exploit.

Note: Content is based on official corporate security notices and third-party threat intelligence analysis.

Credibility flag: Verified Corporate Disclosure

Claimed Facts (5)

• States checkable figures regarding the number of impacted customers disclosed by the company.
• Specifies checkable data categories and the historical date range of the impacted orders.
• Presents a verifiable technical fact regarding device architecture and security integrity.
• Details specific historical metrics of previously disclosed customer records.
• Records a specific timeline and notification date for the security event.

Opinions (4)

• Expresses an emotional reaction and corporate dissatisfaction regarding vendor conduct.
• Outlines theoretical future threat scenarios and predictive risk assessments.
• Presents professional commentary and recommendations regarding enterprise cybersecurity posture.
• Interprets the downstream consequences of the technical database intrusion.

Claims (5)

• Recounts unverified contractual assurances without public documentation from the vendor.
• Relies on second-hand characterizations of ShipMonk remediation without public vendor verification.
• Attribution to a specific threat actor group is reported as an unconfirmed industry assessment.
• Describes broader extortion activities and multiple victims without independent confirmation.
• Uses speculative phrasing regarding whether this specific subset encompasses older order records.

Key Sources

• Trezor — Hardware cryptocurrency wallet manufacturer
• Holborn — Enterprise blockchain security firm
• The Hacker News — Cybersecurity news publication