Data breach at shipping partner Trezor affects 67,000 additional customers

A data breach at shipping partner ShipMonk affects more than 67,000 additional Trezor customers in the United States. These are people who placed an order between November 2019 and August 2021 and whose full personal details were exposed. Trezor reports that it had repeatedly asked ShipMonk to confirm that the data had been deleted, and that it received that confirmation in writing. However, the data was in fact never deleted.

In brief:

• 67,000 additional American Trezor customers are affected by a data breach at shipping partner ShipMonk
• Exposed data includes names, email addresses, phone numbers, shipping addresses and order numbers
• Trezor systems were not hacked and user devices are safe

Data never deleted despite written confirmation

Trezor received an update from ShipMonk two days ago showing that the earlier data breach is larger than initially thought. In addition to previously affected customers, 67,000 American customers who placed orders between November 2019 and August 2021 are now also affected. Their full details, including name, email address, phone number, shipping address and order number, have been exposed.

Trezor states that throughout its collaboration with ShipMonk, it repeatedly received written confirmation that customer data had been deleted, in line with the contract and privacy policy. This later turned out to be incorrect. “We are very disappointed that the data was still present in their systems despite these confirmations,” said Trezor.

Trezor devices remain safe, but customers should remain alert

Trezor stresses that its own systems have not been compromised and that users’ hardware wallets remain safe. Nevertheless, the company advises affected customers to be wary of fake emails, fraudulent phone calls, suspicious letters and possible physical risks. Users are also strongly advised never to share their wallet backup with others or enter it on a website.

All affected customers have been notified directly by email. According to Trezor, anyone who has not received an email has not been affected by this breach. The company is working on anonymous delivery options so that customers can better protect their personal data when placing an order in the future.

More information about the incident can be found on the Trezor blog.