Trezor, the Prague-based maker of hardware wallets, said it is prioritizing an "Anonymous Delivery" service after a breach at shipping partner ShipMonk exposed the home addresses and contact details of more than 11,700 customers.
- The planned checkout would allow customers to use a nickname or label ID and collect orders from automated parcel lockers.
- Packages would carry unbranded wrapping and a generic sender label, while the carrier would use email or text message to provide a pickup code.
Trezor aims to introduce the option in the European Union in September and in the U.S. before the end of 2026. It didn't say, though, whether the service was conceived before the breach or accelerated in response to it.
Breach affected over 13,600 customers
ShipMonk told Trezor about the incident on Aug. 10, according to the company's disclosure.
- Full names, shipping addresses, phone numbers and email addresses were exposed for 11,742 customers.
- Another 1,947 customers had their names, cities and email addresses exposed, bringing the total number affected to 13,689.
The incident involved customers in the U.S., UK, Sweden, Colombia, Brazil, Italy and Portugal who received orders during the 90 days preceding Aug. 8, per the disclosure.
The company warned that the leaked information could nevertheless be used for personalized phishing attempts, including fraudulent emails, phone calls or physical mail.
Commenting on the incident, pcaversaccio, a pseudonymous Ethereum Foundation board member and co-founder of crypto emergency-response group SEAL 911, wrote in an X post that the leak posed a danger beyond the phishing risk highlighted by Trezor.
"The biggest risk is that criminals come to your house and physically attack you," the researcher said, urging users to limit the personal information they disclose online.
Anonymous delivery would reduce address collection
Under the proposed service, customers wouldn't need to provide their home address or legal name for delivery.
Trezor said order information would also be deleted automatically after the package is collected.
The process would still require an email address or phone number so the carrier can issue a pickup code. Trezor recommends using an anonymous email address and paying with cryptocurrency or a disposable digital card for greater privacy.
The company said its existing 90-day data-retention policy limited the scope of the ShipMonk breach. It described the incident as the first since Trezor's founding in 2013 to expose customer phone numbers and physical addresses.