Trezor Says a Shipping Partner Exposed 67,000 More Customer Records It Was Told Had Been Deleted

Trezor, the Czech hardware-wallet maker, said its logistics provider ShipMonk informed it on 2 September that an earlier intrusion exposed the data of about 67,000 additional United States customers. That is on top of roughly 13,700 customers notified in Trezor's first disclosure on 13 August, which implies about 80,689 affected people in total, although neither company has published a combined figure or checked for overlapping rows.

The exposed records include names, email addresses, phone numbers, shipping addresses and order numbers for purchases made between November 2019 and August 2021. Trezor says ShipMonk had given written assurances that older customer data was deleted under its contract and retention policy. The historical order records were still in ShipMonk's systems when attackers reached them. The intrusion itself came through zero-day exploitation of a critical structured-query-language injection flaw in Metabase, an analytics tool, tracked as CVE-2026-72898.

Trezor states that its own infrastructure and devices were not compromised, and that no wallet backups, private keys or device data were exposed. That distinction is real but narrow. The value of this data set to an attacker is not cryptographic. It is a list of home addresses belonging to people who bought a device whose entire purpose is holding bearer assets, which supports both targeted phishing and physical coercion.

The episode reveals a structural weakness in self-custody as it is actually sold. The security model of a hardware wallet protects the key. It does nothing about the retail supply chain that ships the device, and that chain runs through third-party logistics firms whose data-deletion promises are contractual rather than technical.