Unauthorized access to ShipMonk’s systems affected nearly 14,000 Trezor customers, prompting the cold storage crypto wallet maker to disclose the incident. In specifics, 11,742 customers had their names, email addresses, phone numbers, and shipping addresses compromised, while an additional 1,947 customers saw their names, cities, and email addresses affected. The total estimate of affected individuals spans the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.
In a post on X, Trezor acknowledged the breach and explained that a shipping provider’s security lapse exposed sensitive order data. The disclosure underscores a broader trend of rising data breaches, with SentinelOne reporting a 17% year-over-year increase and an average of about 2,090 cyber-attacks per week globally. Month-over-month growth has been modest but persistent since January.
Trezor emphasized that its own systems remained secure and that customers who did not receive notification emails were not impacted. The company noted no confirmed cases of exposed data being published or sold at this time and indicated that orders fulfilled by Amazon were not affected because they are handled by a separate partner. While cryptocurrency wallets themselves were not breached, the risk to affected customers is now more oriented toward phishing and impersonation via email, phone, or postal correspondence.
Security researchers warn that once logistics data is leaked, criminals often repurpose the information to craft new scams for years. Estimates from industry sources suggest that remediation costs for hardware firms can exceed $33 million, with a portion of the risk extending to physical threats. Beyond the data breach, the broader crypto ecosystem has seen comparable incidents, including incidents at Ledger and prior breaches tied to third-party partners. These events illustrate the ongoing challenges for hardware wallet makers in protecting customer information across the supply chain.
