Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
ShipMonk breach exposes 67,000 Trezor customers' data previously thought deleted.
Run Trezor?
Get an email when a reviewed story names Trezor, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Hardware wallet maker Trezor disclosed that a breach at its shipping provider, ShipMonk, exposed data for an additional 67,000 U.S. customers. The exposed information includes names, emails, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021. This incident, attributed to the ShinyHunters gang exploiting a zero-day SQL injection flaw in Metabase (CVE-2026-72898), highlights significant third-party risk and concerns Trezor's assurances about data deletion.
The lesson from this incident
Full lessonTrezor's shipping provider, ShipMonk, was compromised via a zero-day SQL injection vulnerability (CVE-2026-72898) in Metabase, exposing personal data for 67,000 customers despite Trezor's prior assurances that the data had been deleted. This incident illustrates a critical failure in third-party data governance: organizations cannot simply trust vendor claims about data deletion without verification and contractual enforcement. The breach exposes customers to phishing, social engineering, and targeted attacks — particularly dangerous given Trezor's cryptocurrency-focused user base. It also underscores that an organization's security posture is only as strong as its weakest third-party vendor, making rigorous supplier oversight non-negotiable.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
- cve — CVE-2026-72898