Trezor says data breach affects another 67K US customers
Reported by Cointelegraph · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Trezor revealed that a data breach involving its shipping provider, ShipMonk, affected an additional 67,000 US customers beyond the initially reported 14,000. The breached data includes personal details such as names, emails, phone numbers, shipping addresses, and order information, potentially enabling phishing and social engineering attacks targeting these hardware wallet users. Trezor clarified that its own systems were not compromised but blamed ShipMonk for failing to delete customer data as previously assured.
Why it matters
The source highlights that the breach increases the risk of phishing attacks impersonating Trezor in attempts to steal users' seed phrases, thus threatening digital asset holdings. It notes that impersonation scams caused the majority of crypto industry losses in early 2026, amounting to $306 million out of $482 million total losses, indicating that stolen customer details can lead to significant financial harm.
Key context
The breach involves customers who ordered from Trezor between November 2019 and August 2021. Earlier in 2024, Trezor reported about 66,000 users at risk due to contact with its support team since December 2021. Although Trezor’s systems remain secure, the compromised shipping provider data poses indirect security threats through social engineering. The article references a recent high-profile phishing loss of nearly $1 million in July 2026 as an example of the risks involved.
Key numbers and entities
The breach affected an additional 67,000 US customers, on top of the previously reported 14,000. Trezor is the hardware wallet provider, while ShipMonk is the shipping provider responsible for the breach. Total phishing-related crypto losses in Q1 2026 were $306 million out of $482 million. A separate mention refers to a $1 million phishing loss in July 2026.
What remains unclear
The source does not specify the exact nature of the data breach at ShipMonk or how it occurred. It is also unclear what remediation steps, if any, ShipMonk has taken following Trezor’s allegations. The precise identities of any threat actors exploiting the leaked data have not been disclosed.