Fast Facts
- Trezor revealed a data breach affecting 67,000 US customers via its shipping provider, ShipMonk, exposing personal details between 2019-2021, though hardware wallet security remains intact.
- The breach resulted from a zero-day SQL injection vulnerability in Metabase exploited by the ShinyHunters gang, highlighting risks in third-party supply chains.
- Despite assurances of data deletion, ShipMonk failed to remove the information, prompting Trezor to advise customers to remain vigilant against phishing and scams.
- The incident underscores the critical need for organizations to maintain full visibility into third-party risks and secure their supply chains from exploits.
Data Exposure at ShipMonk Affects Thousands of U.S. Customers
Trezor, a well-known manufacturer of hardware wallets, announced that a breach at its shipping partner, ShipMonk, impacted 67,000 U.S. customers. The incident involved unauthorized access between November 2019 and August 2021. Despite assurances from ShipMonk that the data was deleted, the leaked information included customer names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor clarified that this breach did not compromise the security of their hardware wallets. This recent disclosure adds to an earlier incident involving over 13,000 customers, which was believed to be limited due to their 90-day data storage policy.
Breach Details and Security Impacts
ShipMonk notified Trezor about the breach on August 10, 2026, after discovering unauthorized system access. The attack exploited a critical SQL injection flaw in Metabase, a software used by ShipMonk. This vulnerability, identified as CVE-2026-72898, had a perfect score of 10.0 on the CVSS scale, signaling a severe threat. Although ShipMonk claims to have secured and improved their system afterward, the breach highlights the importance of securing the entire supply chain. Experts warn that leaked data could be exploited for scams, such as phishing emails and fake calls, putting affected individuals at risk. This incident underscores the growing need for companies to closely monitor third-party vulnerabilities to protect sensitive customer information.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
DataProtection-V1
