[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVXMenNsDAQeso38g25ELlYxbXs7FgdPzwBVo2Nu3-NU":3},{"article":4,"iocs":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":30,"category":31,"article_tags":35},"525b544f-ca05-4a9b-b344-b5bb148d69e9","Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted","trezor-says-shipmonk-breach-exposed-67-000-u-s-customers-data-it-said-was-delete-285490","Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets","Hardware wallet maker Trezor disclosed that a breach at its shipping provider, ShipMonk, exposed data for an additional 67,000 U.S. customers. The exposed information includes names, emails, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021. This incident, attributed to the ShinyHunters gang exploiting a zero-day SQL injection flaw in Metabase (CVE-2026-72898), highlights significant third-party risk and concerns Trezor's assurances about data deletion.","ShipMonk breach exposes 67,000 Trezor customers' data previously thought deleted.","Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted Ravie LakshmananSep 05, 2026Data Breach \u002F Vulnerability Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets. \"Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,\" Trezor said. \"We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.\" The exposure is in addition to 13,689 customers the company disclosed last month as having had their data either fully or partially exposed. The breach, it noted at the time, was limited during its 90-day data storage policy. Trezor said ShipMonk informed the hardware wallet maker of a breach on August 10, 2026, following unauthorized access to their systems. Subsequently, it revealed that the 1,947 customers whose exposure was limited only to names, cities, and email addresses (excluding the shipping addresses) may include older orders. \"After 90 days we delete or anonymize all customer data related to a purchase on our Trezor eShop,\" the company said. \"We chose 90 days because it is the shortest window that still covers the whole life of an order — delivery, returns, and any refund or replacement. After that we have no reason to keep your address or phone number.\" ShipMonk has yet to acknowledge the incident publicly. The logistics company is said to have secured the affected systems and improved its security after the digital break-in, which involved the zero-day exploitation of CVE-2026-72898 (CVSS score: 10.0), a critical SQL injection flaw in Metabase. According to enterprise blockchain security firm Holborn, the ShinyHunters extortion gang is said to be behind the breach. Trezor said it has notified affected customers directly. However, it warned users to be on the lookout for social engineering attacks and scams, as bad actors can exploit the leaked information to send phishing emails or letters, make fake phone calls, and even impersonate the company in email communications to persuade targets into taking unintended actions. \"The leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks,\" Trezor said. Holborn said the software supply chain attack highlights the need for organizations to have complete visibility into their third-party risk exposure in order to help manage their overall security posture. \"The Trezor breach was the result of a supply chain attack beginning with a zero-day vulnerability,\" it said. \"By finding and exploiting the SQL injection flaw in Metabase, the attackers were able to exploit several of its customers, stealing sensitive data and extorting the organization.\" \"In Trezor's case, this meant the exposure of customer order details that were stored in a Metabase instance by ShipMonk.\" Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cryptocurrency, data breach, Supply Chain, Vulnerability, Web Security ⚡ Top Stories This Week Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication Learn How to Build Security Operations Ready for AI-Powered Attacks Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows Frontier AI: Vulnerability Management's Systemic Revolution Why AI Teams Need Verifiable Search Data Instead of Black-Box Signals Why Threat Intelligence Needs OT Context to Protect Critical Infrastructure ⭐ Featured Resources See How Keeper Secrets Manager Removes Hard-Coded Credentials Download the CISO's Guide to Smarter AI Security Investment Phishing Is Costing Security Teams More Than Ever — Read the New Report Build AI Agents and Automations Without Losing Security Control","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ftrezor-says-shipmonk-breach-exposed.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhIuPjOUFz-c7o9qipnKr4soYR6NxJJxAYgcDqwTPl3LB5XXiag7UpIq8-qFzCbiC1cnlpWfyaRvAt9MVxIlSXeuEN_97devL_mSI25Ee73cO47vDq4dqsM8Nq08d7FogI7sVIPWlnMTD-Una_rRwyTyXqKG6am2DrU_EoIESLicWgDvpxsw6e8yAHmJnGI\u002Fs1600\u002Ftrezor.jpg","2026-09-05T14:17:02+00:00","2026-09-05T16:00:05.967708+00:00",8,[18,21,24,27],{"name":19,"type":20},"Metabase","product",{"name":22,"type":23},"Trezor","vendor",{"name":25,"type":26},"ShinyHunters","threat_actor",{"name":28,"type":29},"ShipMonk breach","campaign","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":30,"icon":32,"name":33,"slug":34},null,"Breaches","breaches",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-72898","SQL injection flaw in Metabase exploited in the breach"]