ShipMonk told Trezor on August 10, 2026 that an unauthorized actor had reached customer order data, exposing the full names, phone numbers, email addresses and street addresses of 11,742 hardware wallet buyers. Trezor said it is the first such exposure since 2013.
What to Know?
- ShipMonk, the logistics partner that stores and ships Trezor orders, disclosed unauthorized access to systems holding customer records.
- Trezor buyers in seven countries are affected, covering the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.
- Partial records for another 1,947 people were exposed, limited to name, city and email address.
- Orders delivered between May 10 and August 8, 2026 fall inside the exposed window. Older orders had already been deleted.
- Trezor confirmed its own systems were not touched and that the devices themselves remain secure.
How It Happened?
ShipMonk stores Trezor inventory and ships orders to customers in the US, UK and several other markets, which is why it holds a buyer’s name, email, order number, phone number and delivery address. Trezor’s contract requires those partners to delete or anonymize order data 90 days after delivery. That clause is why the count stopped at 13,689 people rather than every order placed since the eShop opened.
Trezor published the disclosure on its company blog and emailed everyone affected from help@trezor.io. “Our systems were not compromised, and your Trezor device is secure, but the affected customers might be targeted by more sophisticated phishing attempts,” the company wrote. ShipMonk has secured the affected systems and tightened its security since the incident, according to that notice.
We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days…
— Trezor (@Trezor) August 13, 2026
A Shipping List Carries Risks an Email List Does Not
The exposed records tie a verified street address and phone number to a confirmed purchase of a device built to hold cryptocurrency. Trezor’s guidance covers fraudulent contact: fake emails, spoofed calls, printed letters, and impersonation of banks, exchanges or Trezor itself. The notice does not address what an address list means for a buyer’s physical security.
The evidence has a hard boundary worth stating. A delivery record proves someone bought a wallet; it says nothing about what that wallet holds, and none of the disclosed material suggests balances, seed phrases or account credentials were involved. The wider identity theft statistics explain why the set still matters, because name plus address plus phone is the combination that makes impersonation cheap.
What Trezor Has Not Explained?
Four gaps remain open in the disclosure:
- How the attacker got into ShipMonk’s systems, which Trezor describes only as an ongoing investigation?
- How long the access lasted before ShipMonk detected it?
- Whether customer records belonging to ShipMonk’s other clients were reached in the same intrusion?
- Whether any of the data has surfaced for sale or been used yet?
Buyers who ordered in that window should check their inbox and spam folder for mail from help@trezor.io, since Trezor says that message is the only confirmation of exposure. Treating any unsolicited call, letter or email that references a recent order as hostile until it is verified through official Trezor channels helps reduce the risk of a successful follow-on scam, as does the standing rule never to type a wallet backup into a website. The tactics resemble the phishing campaign against Robinhood users, where legitimate looking messages did the work.
SQ Magazine’s Takeaway
Data retention policy did the heavy lifting in this incident. Trezor’s 90-day deletion rule, pushed down to fulfillment partners by contract, converted an unbounded exposure into a bounded one, and the difference between 13 years of order history and one quarter of it is the entire story of how bad this could have been. The lesson for consumer hardware companies is that the weak point sits in the fulfillment layer, where a partner needs real customer data to put a box on a doorstep.
What’s next? The ShipMonk investigation continues, and Trezor has not said when it expects findings. The company has committed to an Anonymous Delivery option using a dedicated checkout, locker pickup, neutral packaging, generic sender details and automatic deletion of shipping identifiers after delivery, aimed at the EU by September 2026 and the US by the end of 2026. Affected buyers should expect a rise in targeted phishing attempts across email, phone and post in the meantime.
