Trezor, the Prague-based hardware crypto wallet maker, says ShipMonk, its shipping provider, retained data on another 67,000 U.S. buyers dating back to 2019 despite a 90-day retention policy meant to keep old customer records out of reach.
- Trezor said in a Friday post on X, Sept. 4, that its shipping provider informed it on Sept. 2 that last month's breach was substantially larger than previously disclosed.
- Another approximately 67,000 U.S. customers who ordered Trezor products between November 2019 and August 2021 had their full names, email addresses, phone numbers, shipping addresses and order numbers exposed, according to an updated disclosure.
- That brings the known number of affected Trezor customers to roughly 80,689, up from the 13,689 originally disclosed.
- The increase amounts to about 489%, meaning the known victim count is now nearly six times the original estimate.
Trezor initially said 11,742 customers had their names, emails, phone numbers and shipping addresses exposed, while another 1,947 suffered a more limited exposure.
Adding the newly disclosed group brings the full-exposure count to roughly 78,742, about 6.7 times the original figure.
'Older data had already been deleted'
Initially, Trezor pointed to data deletion as the reason the breach wasn't substantially larger. In its Aug. 13 disclosure, Trezor said the incident was "limited" by its strict 90-day data-storage policy, which it said had also been negotiated with fulfillment partners.
Its FAQ went further, saying only orders received within 90 days before Aug. 8 were affected because "older data had already been deleted." Trezor also said partners were required to delete or anonymize order information after 90 days.
Another 67,000 customers from the US who ordered between November 2019 and August 2021… https://t.co/yDQvTlAA2S— Trezor (@Trezor) September 4, 2026
That apparently wasn't the case at ShipMonk as Trezor now says that throughout its relationship with the shipping provider it had "repeatedly requested and received written assurance" that customer data was being deleted in accordance with their contract and data policy.
Trezor
The newly exposed information comes from orders placed between November 2019 and August 2021, meaning some of the records had apparently survived for almost seven years despite the 90-day deletion requirement.
Wallets weren't compromised
The incident involved ShipMonk rather than Trezor's wallet infrastructure and Trezor said its systems weren't compromised and customers' devices remain secure.
But the type of information exposed carries an unusual risk for hardware-wallet owners as it potentially connects people's identities and physical addresses with their use of a device designed to hold crypto.
Trezor warned affected customers to watch for fake emails, phone calls and fraudulent letters, as well as potential physical-security threats. The company said everyone identified in the newly discovered dataset has been contacted directly.
- The original ShipMonk incident was linked to a vulnerability in third-party analytics software Metabase.
- ShipMonk told affected customers that an unauthorized party exploited the software to access customer information, according to breach notifications reviewed by BleepingComputer.
- The outlet also reported that ShipMonk subsequently received extortion emails from the ShinyHunters group.
- Trezor is now working to roll out an anonymous-delivery option that would reduce the amount of personally identifiable information customers need to provide when buying a hardware wallet.