Trezor, a manufacturer of hardware cryptocurrency wallets, has confirmed that a data breach at one of its logistics partners, ShipMonk, exposed the personal details of over 13,000 customers. The exposed information includes names, email addresses, phone numbers, and shipping addresses.
Initially, Trezor believed the breach was limited to orders placed within the previous 90 days in specific countries. However, subsequent investigation revealed that earlier orders were also impacted. The company is currently working with ShipMonk to verify the full scope and timeframe of the exposure.
The breach specifically affected 11,742 customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who purchased Trezor products between May 10 and August 8. For this group, names, email addresses, phone numbers, and shipping addresses were compromised.
An additional 1,947 customers had their names, home cities, and email addresses exposed. Some individuals in this group may have placed their orders before May 10.
ShipMonk, Trezor's logistics partner, is responsible for storing and shipping products and collecting necessary customer information for order fulfillment. Trezor's policy requires partners to delete or anonymize customer data within 90 days of collection.
Trezor emphasized that its own systems and hardware devices remain secure. However, it warned affected customers to anticipate an increase in phishing attempts, as the exposed data could be used by criminals to craft convincing scams impersonating banks, cryptocurrency exchanges, or even Trezor itself.
The company has directly contacted affected customers and advised them to cross-reference any communications with information published on its official channels. Trezor reiterated a critical security warning: "Never enter your wallet backup on a website or share it with anyone."
Acknowledging the severity of the incident, Trezor stated this is the first time since its founding in 2013 that customer phone numbers and shipping addresses have been compromised. The company expressed deep regret for the breach and the potential risks it poses.
Beyond phishing, the exposed data could potentially facilitate physical attacks against cryptocurrency holders. Instances of kidnappings and robberies targeting wealthy cryptocurrency owners have been reported in France, the US, and other regions. A list linking hardware wallet buyers to their home addresses could be valuable to such criminal enterprises.
In response to the breach, Trezor announced that its top priority is to launch an "Anonymous Delivery" option. This service, expected to debut in the EU by September and in the US by year-end, will allow customers to complete purchases without linking their real-world identity or home address to an order.
Customers using Anonymous Delivery will utilize a dedicated checkout process, provide a nickname or label ID instead of a real name, and have their product shipped to an automated delivery locker. The packaging will be unbranded with a generic sender label, and the carrier will use only email or SMS to provide a PIN for locker access.
