HARDWARE wallet maker Trezor has disclosed that a breach at its shipping partner ShipMonk exposed data belonging to 67,000 U.S. customers, despite the data being flagged for deletion. The affected records include names, email addresses, phone numbers, shipping addresses and order numbers dating from November 2019 to August 2021. Trezor stressed that the breach does not compromise the security of its hardware wallets.
It said it had repeatedly obtained written assurances that the data would be deleted in ShipMonk’s systems, but that confirmation failed to translate into actual deletion.
The incident follows ShipMonk’s admission on 10 August 2026 of unauthorised access to its systems. In total, 69,436 customers were impacted across two disclosures, with 1,947 exposed data limited to only names, cities and emails (potentially older orders). ShipMonk’s breach involved a zero-day in Metabase, CVE-2026-72898, exploited to access a Metabase instance handling customer data. Holborn situates the attack as a supply-chain compromise attributed to the ShinyHunters extortion group.
Trezor has notified affected customers directly and cautions users to be vigilant for phishing, social engineering and impersonation attempts using leaked contact details.
Holborn emphasises the wider risk across third-party relationships, while Trezor notes that the 90-day data retention policy was designed to cover the full order lifecycle, including returns and refunds, after which data is deleted or anonymised. ShipMonk has reportedly secured the compromised systems and strengthened its security posture, though the company has not issued a public acknowledgment at the time of the disclosure.