Published on August 14, 2026
Trezor Data Breach Exposes Personal Information of Nearly 14,000 Customers
Severity
Medium
Detail
Hardware wallet manufacturer Trezor disclosed a data breach involving ShipMonk, a third-party shipping provider. The incident exposed personal information belonging to 13,689 Trezor customers. ShipMonk notified Trezor on August 10, 2026, that an unauthorized party had accessed systems containing customer order information. Trezor publicly disclosed the incident on August 13 while continuing its investigation.
The affected information did not include Trezor’s internal systems, hardware wallets, private keys, wallet backups, or cryptocurrency holdings. However, the exposed customer information could create risks for phishing, social engineering, and physical security.
How?
The breach occurred at Trezor’s third-party shipping provider, ShipMonk, rather than within Trezor’s own systems. The compromised information was associated with customer orders. The breach affected 11,742 customers whose records contained their full names, email addresses, phone numbers, and complete shipping addresses.
Another 1,947 customers had partial information exposed, including their names, cities, and email addresses. Trezor was still determining whether those partially exposed records also contained information from older orders. The affected customers are believed to be individuals whose Trezor orders were shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal between May 10 and August 8, 2026.
Impact
The exposure could allow threat actors to identify individuals as Trezor hardware wallet users and use the leaked information to conduct targeted social-engineering attacks. Attackers could potentially impersonate Trezor support, cryptocurrency exchanges, banks, logistics companies, or government organizations through emails, SMS messages, telephone calls, or physical letters.
These scams could claim that a customer’s wallet requires a firmware update, that an order needs verification or that cryptocurrency assets are at immediate risk. A key objective of such attacks could be obtaining the victim’s wallet recovery seed. Anyone who obtains a recovery seed can restore the wallet and transfer its cryptocurrency assets without requiring the physical Trezor device. Trezor stated that the breach did not compromise its internal systems, hardware wallets, private keys, wallet backups, or customers’ cryptocurrency holdings.
Recommendation
Affected customers should treat unexpected communications relating to Trezor, cryptocurrency holdings, deliveries or account security as potentially malicious. Users should avoid following links or calling telephone numbers contained in unsolicited messages and should instead access Trezor through its official channels.
Customers must never provide their wallet recovery seed through a website, telephone call, email, or chat. Trezor support personnel will not request a recovery seed.
Recommended precautions include using an anonymous email address for purchases, paying with cryptocurrency or disposable virtual payment cards when possible, and utilizing a P.O. Box to reduce exposure of residential addresses.
Trezor has announced plans for an Anonymous Delivery option featuring locker pickup, neutral packaging, generic sender information, and removal of shipping identifiers after delivery. The service is expected to launch in the European Union by September 2026 and in the United States by the end of 2026.
Conclusion
The Trezor incident demonstrates the security risks that can arise from compromised third-party service providers holding customer information. Although the breach did not expose Trezor wallets, private keys, wallet backups, or cryptocurrency holdings, the leaked personal and shipping information could be used to identify Trezor customers and conduct highly targeted phishing and social-engineering attacks. Customers should therefore remain alert to suspicious communications and, most importantly, never disclose their wallet recovery seed to anyone.
Source
https://gbhackers.com/trezor-shipping-provider-data-breach/
https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/