TREZOR says a data breach at its fulfilment partner ShipMonk has exposed customer order data for about 80,000 individuals. The initial wave affected 13,689 people across seven countries, with 11,742 showing full exposure and 1,947 partial exposure. On 4 September 2026, Trezor disclosed that the breach extended to around 67,000 more US customers who had placed orders between November 2019 and August 2021.
Importantly, the compromised records include names, phone numbers, email addresses and shipping addresses; no private keys, wallet backups or devices were touched, and Trezor asserts that its own systems remained secure.
How it happened, and what it means for victims, is that ShipMonk reported the intrusion after attackers exploited a flaw in the Metabase analytics platform. This was described as a critical SQL injection zero‑day in Metabase, now patched; the breach is characterised as a third‑party vendor incident rather than a direct hack of Trezor.
Trezor has apologised and is working with ShipMonk to confirm the full timeline, while also offering an Anonymous Delivery feature aimed at removing shipping identifiers after delivery (targeting the EU by September 2026 and the US by year end). The practical guidance to affected individuals is to check for messages from help@trezor[.]io, treat any requests for personal details with suspicion, never enter wallet backups online, and verify communications against Trezor’s official channels.
CoinDesk has reported no confirmed misuse of stolen data to date. CVE Watchtower’s live alerts list several current exploits, including CVE-2026-85046 related to a Google Chrome V8 type confusion issue, underscoring the broader threat landscape surrounding third‑party data risks.