Trezor data exposed in ShipMonk breach

Trezor said a breach at its logistics and shipping provider ShipMonk exposed customer order information, including full names, shipping addresses, phone numbers and email addresses. The company said the incident may affect new customers who received an order in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal between May 10 and August 8, 2026.

Scope of the incident

According to Trezor’s statement, ShipMonk stored the data needed to deliver packages, including name, email address, order number, phone number and shipping address. The company said only orders from the 90 days before August 8, 2026 could have been exposed because of a 90-day data deletion policy.

CoinDesk reported that the warning reached nearly 14,000 users. In that report, the company said 11,742 customers had full exposure of name, shipping address, email address and phone number, while another 1,947 were partially exposed, with name, city and email address.

The regional scope includes customers in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal. Bloomberg also said the breach affected users who had received an order within the 90 days before August 8, 2026, including in Brazil.

What Trezor said about its systems

The company said the breach stemmed from unauthorized access to ShipMonk systems that contained customer data. It also said its internal investigation is still ongoing.

Trezor stressed that its own systems, products and services were not affected. According to its statement, no hardware wallet or private keys were compromised. Yahoo News reported the same position and added that devices, private keys and wallet backups were also not hit.

Provider response

BleepingComputer reported that ShipMonk attributed the incident to a vulnerability exploited in Metabase, the third-party analytics platform it used. According to that report, the flaw has already been patched and active sessions were invalidated. The same outlet said ShipMonk began a detailed technical investigation with help from outside IT experts.

Protos said Trezor is still gathering information about the incident and will decide on the future of its relationship with ShipMonk once it has the full picture.

CryptoRank added that the company plans to introduce Anonymous Delivery in the European Union in September 2026 and in the United States before the end of the year, as a mitigation measure after the breach.