Trezor reports 67,000 additional US customers affected

Hardware wallet maker Trezor announced Friday that a data breach involving its shipping partner, ShipMonk, has exposed the personal and order information of approximately 67,000 additional U.S. customers. This expansion significantly broadens the scope of an incident initially disclosed in August. ShipMonk informed Trezor on September 2 that the breach included older order data from a contract period spanning November 2019 through August 2021. The newly identified records contain customers' full names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor stated it had repeatedly requested ShipMonk to delete this data throughout their business relationship and had received written assurances that it had been removed in accordance with their contract and data policies. The company expressed disappointment that the records remained in ShipMonk's systems despite these confirmations. The initial breach, disclosed on August 13, affected an estimated 13,689 customers. Those earlier records, primarily from May 10 to August 8, 2026, involved names, email addresses, phone numbers, and shipping addresses for some, and names, cities, and email addresses for others.