ShipMonk data breach exposes personal information of 14,000 Trezor hardware wallet customers

Aug 13, 2026

Hardware wallet manufacturer Trezor announced that a data breach at its shipping partner, ShipMonk, exposed the personal details of 13,689 customers across seven countries who ordered devices between May 10 and August 8, 2026. The breach, caused by a Metabase SQL injection vulnerability, leaked names, emails, phone numbers, and shipping addresses. While Trezor's own systems and devices remain secure, the company warned users of heightened phishing and social engineering risks.

ShipMonk data breach incident

▪Trezor notified all affected customers of the ShipMonk data breach via direct email communications.
▪Trezor's third-party fulfillment partner, ShipMonk, experienced unauthorized access to its systems containing customer data, which was publicly disclosed on August 13, 2026.
▪The ShipMonk data breach affected Trezor customers who received orders between May 10, 2026, and August 8, 2026.
▪Trezor customers who purchased their hardware wallets through Amazon were unaffected by the ShipMonk breach because those orders are managed by a different logistics provider.

Metabase SQL injection vulnerability

▪ShipMonk stated that the data breach occurred because attackers exploited a critical SQL injection zero-day vulnerability in Metabase, an analytics platform used by ShipMonk.
▪Metabase publicly flagged the SQL injection vulnerability on August 6, 2026, which also affected other companies including laptop manufacturer Framework and form builder Tally.
▪Following the ShipMonk data breach, ShipMonk received extortionary emails from the ShinyHunters hacking group.

Exposed customer personal information

▪Among the affected Trezor customers, 11,742 had their full names, email addresses, phone numbers, and shipping addresses exposed.
▪The ShipMonk data breach marks the first time in Trezor's 13-year operating history that customer telephone numbers and physical shipping addresses were compromised.
▪A subset of 1,947 affected Trezor customers had only their names, cities, and email addresses exposed in the ShipMonk breach.
▪The ShipMonk data breach exposed the personal information of 13,689 Trezor customers across the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.

Phishing risk warnings

▪Trezor urged customers to never enter their wallet backup recovery phrases on any website or share them with anyone.
▪In response to the ShipMonk breach, Trezor announced it is developing an anonymous delivery option with lockers, neutral packaging, and automatic data deletion, aiming to launch in the European Union by September 2026 and in the United States by the end of 2026.
▪Trezor warned that the exposed customer data could be used by cybercriminals to launch sophisticated phishing and social engineering campaigns, such as sending fake emails or making fraudulent phone calls.

Trezor infrastructure security status

▪Trezor emphasized that its own internal systems, proprietary firmware, and device-level security protocols were not compromised and remain secure.
▪Trezor stated that as of August 13, 2026, there was no evidence that the compromised customer data had been published, sold, or used in any fraudulent schemes.

Hardware wallet breach history

▪Hackers drained over $111 million in Bitcoin from Coldcard hardware wallets manufactured by Coinkite at the end of July 2026 due to a vulnerability associated with recovery phrases.
▪In January 2026, Trezor's competitor Ledger experienced a customer data leak linked to its third-party e-commerce partner, Global-e.
▪Ledger previously suffered a major data breach in 2020 that exposed the personal contact data of nearly 300,000 users, which later led to scammers mailing counterfeit hardware wallets to victims.
▪Trezor previously experienced security incidents in January 2024, which affected 66,000 users via a third-party support portal, and in April 2022, which compromised data of over 106,000 customers.