If you bought a Trezor and used ShipMonk shipping, this one hits close to home. Trezor says a breach at its shipping/logistics partner ShipMonk started as ~14,000 impacted customers, then ballooned to 81,000 after ShipMonk allegedly didn’t delete older customer records like it was supposed to . No, Trezor devices weren’t hacked. No, your wallet isn’t suddenly “open.” But your personal order details can still be fuel for scams that feel uncomfortably real—emails, calls, even physical mail—because the leaked dataset includes the stuff scammers use to sound legitimate .
What happened (and why the number jumped from ~14,000 to 81,000)
If you’re trying to make sense of the Trezor ShipMonk data breach, the confusing part is the headcount. How does a breach go from “nearly 14,000 customers affected” to 81,000?
It wasn’t a second, brand-new incident. It was the same ShipMonk breach… plus older customer records that apparently shouldn’t have still been sitting there.
The short timeline (what Trezor disclosed)
Trezor’s initial update said attackers accessed ShipMonk-held customer data tied to about 14,000 people. That initial impact included customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026 .
Then Trezor published a follow-up: the scope expanded by an additional 67,000 U.S. customers, bringing the total to 81,000 .
Why the count “ballooned”
According to Trezor, the newly counted 67,000 were U.S. customers who ordered between November 2019 and August 2021 . The key detail is why those older orders were even in play.
Trezor says ShipMonk failed to delete exposed data from its systems as required by Trezor’s contract and data policy . Trezor also stated it had repeatedly asked for deletion and received written assurances confirming deletion, but later found the data was not deleted .
That’s the core reason the number jumped: investigators didn’t just find “recent shipping records.” They found a longer tail of retained customer order details tied to older purchases—exactly the kind of historical data most people assume is long gone.
If you ordered a Trezor in the U.S. in that Nov 2019–Aug 2021 window, you’re in the group that likely didn’t think this breach applied to you. It might.
Exactly what was exposed (and what wasn’t)
When people hear “Trezor data breach,” they often jump straight to the worst-case scenario: someone got into my wallet.
That’s not what Trezor is saying happened here. This incident sits in the order-details category, coming from a third-party logistics/shipping database (ShipMonk), not from your hardware wallet.
What was exposed in the ShipMonk breach
Trezor’s update describes the exposed dataset as full customer details—the stuff scammers use to sound legitimate on the first try :
- Full name
- Email address
- Phone number
- Shipping address
- Order number
That combination matters. A random email leak is annoying. A leak with your name + phone + address + “proof” you bought a Trezor (order number) is what makes phishing feel real.
What wasn’t exposed (the line that actually matters)
Trezor also said the breach did not affect its operations or services, that Trezor’s systems were not compromised, and that all Trezor devices are secure .
So this isn’t a “wallet backdoor” situation. The main risk is downstream social engineering—messages that push you to hand over something sensitive because the sender seems to “know” your order.
Trezor explicitly warned customers to be wary of messages requesting personal information because the leaked data could be used for scam emails, fraudulent calls, or letters .
Why this breach is dangerous: phishing that feels personal + real-world safety
Once your order details are out, attackers don’t need to “hack your wallet.” They just need to talk you into handing them the keys.
Trezor specifically warned customers about an increased risk of phishing, saying the leaked info could be used for scam emails, fraudulent calls, or letters . That warning matters because the data exposed is the exact context scammers use to sound like the real shipping partner or “Trezor support.”
How order details get weaponized (the script writes itself)
Expect messages that feel like they’re picking up a real conversation you never started:
- “We’re calling about your Trezor shipment… we need to confirm your address.”
- “Your order is on hold. Verify your order number to release it.”
- “Security alert: your wallet is at risk. Follow these steps to ‘re-secure’ it.”
That last one is the trap. The end goal is usually a recovery-seed theft attempt.
Trezor has seen this playbook before. Reporting notes that after a prior Trezor-related breach, stolen personal data was used in phishing attacks attempting to steal recipients’ 24-word wallet recovery seeds . Attackers recycle what works.
The tell: urgency + “verification”
Phishing around crypto almost always uses:
- Urgency (“act now or funds will be lost”)
- Authority (“support,” “shipping,” “compliance”)
- A single ‘verification’ step that’s actually the theft step (seed phrase, fake app install, fake form)
Real-world safety: why addresses change the vibe
An exposed email is digital risk. An exposed shipping address adds a physical angle.
Trezor didn’t sugarcoat it: the leaked info could “potentially expose affected individuals to physical security risks” .
No panic needed, but it’s smart to treat unexpected contact as suspicious, especially anything that:
- shows up as a “support letter” in the mail
- references your purchase to build trust
- tries to move you off-email (to phone/WhatsApp/Telegram) where scams are harder to trace
How attackers may have gotten in: Metabase SQLi rumors and extortion signals
The “how did they get in?” part matters for one reason: it tells you this wasn’t some attacker guessing a password. It looks like a supplier tool got hit, and customer data was the payout.
The likely entry point: Metabase, not Trezor
Trezor hasn’t publicly laid out ShipMonk’s full technical root cause. Still, breach notification emails shared with reporters reportedly pointed to attackers exploiting a vulnerability in Metabase (a third-party analytics platform) .
Metabase later said threat actors exploited a critical SQL injection (SQLi) zero-day to breach customer instances and run data theft attacks after gaining administrator access to the compromised instance .
If you’re not technical, here’s the simple version:
- Metabase is a “dashboard” tool that connects to databases so teams can query and visualize data.
- SQL injection is when an attacker tricks a system into running database commands it never should.
- If the attacker gets admin-level access to the instance, they can often pull reports, export tables, or query sensitive data directly .
That’s a clean recipe for an “order details” breach: no need to break hardware encryption or touch wallet firmware. Just steal what’s already sitting in a business system.
Why you’re hearing “extortion” in the same breath
Reporting also says ShipMonk received extortion emails tied to the ShinyHunters extortion gang .
Extortion changes the shape of an incident:
- Attackers push deadlines and pressure (“pay or we leak/sell”).
- Data gets packaged, re-packaged, and re-counted as more sources are found.
- Public impact numbers can creep upward as investigators uncover more retained or accessible records.
This Metabase campaign didn’t hit just one company. The same reporting notes other organizations (including Tally and Framework) disclosed breaches after their Metabase instances were hijacked .
What to do next: a calm, tactical checklist (seed scams, account lockdown, and safe responses)
You can’t un-leak data. You can make it a lot harder to use against you.
1) Lock in the one rule that saves wallets
Never share your recovery seed.
Not with “support.” Not with “shipping.” Not with anyone.
If someone asks for your seed phrase (12/18/24 words) for any reason, it’s a scam. Full stop.
2) Treat every “Trezor/ShipMonk” outreach as untrusted until proven
Attackers will use the stolen order context to sound official. Don’t argue with them. Don’t “verify” anything.
Do this instead:
- Don’t click links in emails/SMS, even if they reference your order.
- Don’t call back numbers provided in the message.
- If you want to check something, go directly to the official site by typing it in yourself, then use the official support route from there.
- If someone calls, ask for a ticket number and tell them you’ll contact support yourself. Then hang up.
3) Harden your “reachable” channels (email + phone)
Your email and phone are the main targets after an order-details breach.
- Change your email password (use a password manager).
- Turn on two-factor authentication (an authenticator app is better than SMS when possible).
- Create a mail rule to flag or label anything containing: “seed phrase,” “wallet verification,” “KYC,” “shipment on hold,” “urgent,” “action required.”
Phone
- Expect more spam and “support” calls for a while.
- Don’t confirm personal details on inbound calls, even if they already know them.
- Consider setting your carrier’s SIM swap / port-out PIN if you haven’t.
4) Reduce repeat exposure on future orders (practical privacy layer)
Breaches often chain together because we reuse the same contact info everywhere.
If you want to cut down how often your real email/number gets recycled into phishing, tools like Cloaked help by giving you masked emails and phone numbers you can use for signups and deliveries. If a vendor or logistics partner gets breached, you can shut off that alias without burning your primary identity.
5) Document anything suspicious (it helps you spot patterns)
Keep a simple log for a few weeks:
- date/time + channel (email/SMS/call/mail)
- sender address/number
- what they asked you to do
- screenshots or photos
If a scam campaign ramps up, those details make it easier to report and block the right things fast.
