The Trezor data breach has now exposed approximately 80,700 hardware wallet customers after a third-party logistics provider, ShipMonk, suffered a security intrusion that went far beyond the company’s initial disclosure. Trezor first announced the incident on August 13, 2026, reporting that roughly 13,689 customers were affected.
By September 4, 2026, the company revealed that an additional 67,000 U.S. customers had their personal data compromised through the same breach, stretching the exposure window back to orders placed between November 2019 and August 2021. For cryptocurrency fraud victims and hardware wallet owners alike, this breach raises serious concerns about phishing, social engineering, and the security of vendor supply chains.
What Happened in the Trezor Data Breach
Attackers exploited CVE-2026-72898, a critical SQL injection vulnerability rated CVSS 10.0 in the Metabase analytics platform used by ShipMonk, Trezor’s third-party fulfillment provider. The flaw allowed unauthenticated access through Metabase’s reset password endpoint, giving attackers administrator-level control and the ability to extract customer order data. The breach has been attributed to the ShinyHunters extortion group, which reportedly sent extortion communications following the intrusion.
ShipMonk notified Trezor of the unauthorized access on August 10, 2026. Trezor’s initial disclosure on August 13 covered 13,689 customers (11,742 with full exposure and 1,947 with partial exposure) from orders shipped between May 10 and August 8, 2026. The scope expanded on September 4, when Trezor revealed an additional 67,000 U.S. customers from orders placed between November 2019 and August 2021 were also affected. That historical data had reportedly been retained in ShipMonk’s systems despite contractual deletion requirements. No Trezor devices, private keys, seed phrases, or wallet backups were compromised.
The exposed data includes customer names, email addresses, phone numbers, shipping addresses, cities, and order numbers.
- September 4, 2026: Trezor revealed 67,000 additional U.S. customers (orders from November 2019 to August 2021), bringing the total to roughly 80,700.
- August 13, 2026: Trezor disclosed the breach affecting 13,689 customers (orders from May 10 to August 8, 2026).
- August 10, 2026: ShipMonk notified Trezor of unauthorized access.
We Have Recovered Over
$350 Million for Our Clients Nationwide.
What This Means for Investors
Although the Trezor breach did not touch wallets or private keys, the exposed data confirms that affected customers own a hardware wallet, which makes them high-value targets for phishing attempts, SIM-swapping, and social-engineering attacks designed to extract recovery phrases or authorize fraudulent transfers. Trezor and multiple cybersecurity outlets warn customers to expect contact by phone, email, and postal mail. Trezor states it will never ask for wallet backups or seed phrases, and any communication requesting that information should be treated as fraudulent.
The incident reflects a broader pattern of third-party vendor risk across the cryptocurrency industry. When companies outsource fulfillment or analytics, they distribute custody of sensitive customer data across multiple attack surfaces. A vendor retaining historical records that were contractually required to be deleted can dramatically expand the scope of a breach, as the ShipMonk situation illustrates. The 2025 Coinbase data breach raised similar concerns about how platforms vet and monitor their third-party partners.
Customers who suspect their information has already been used in an unauthorized transaction should know what to do in the first 24 hours after crypto is stolen and how to file an IC3 report for cryptocurrency-related fraud to create a formal record for any future legal action.
How Meyer Wilson Werning Can Help
Meyer Wilson Werning represents investors nationwide in cases involving cryptocurrency fraud and losses connected to negligent security practices. With more than 75 years of combined experience and over $350 million recovered for clients since 1999, the firm’s legal team has a track record of holding companies accountable when negligence leads to investor harm.
If a licensed broker or financial adviser recommended crypto investments, helped arrange the purchase, or held the assets, there may be a claim against that professional or their firm. Meyer Wilson Werning may be able to help you explore your legal options, contact us today for a free and confidential consultation.
Our lawyers are nationwide leaders in investment fraud cases.
Frequently Asked Questions
Was the Trezor data breach a hack of Trezor wallets or a third-party vendor?
Public reporting indicates that the incident was a breach at ShipMonk, Trezor’s third-party shipping and logistics provider, after attackers exploited a critical SQL injection vulnerability in the Metabase analytics platform ShipMonk used. No Trezor devices or wallet infrastructure were directly compromised.
What customer information was exposed in the Trezor ShipMonk breach?
The exposed data includes customer names, email addresses, phone numbers, shipping addresses, cities, and order numbers tied to Trezor purchases fulfilled by ShipMonk. No private keys, wallet backups, or seed phrases were reported as compromised.
How many Trezor customers have been affected by the ShipMonk data breach?
Across the initial August 13, 2026 disclosure of 13,689 customers and the September 4, 2026 update involving about 67,000 additional U.S. customers, roughly 80,700 Trezor buyers were affected by the ShipMonk breach.
Is my cryptocurrency at risk after the Trezor data breach?
Trezor’s systems, devices, private keys, and wallet backups were not touched by this breach. However, the exposed personal and order data significantly increases the risk of targeted phishing and social-engineering attacks designed to trick customers into disclosing their recovery phrases or approving fraudulent transfers.
Recovering Losses Caused by Investment Misconduct.