Reported by 3 outlets

Timeline

1. original reporting

   14,000 Trezor Customers Impacted by Data Breach at ShipMonk

   securityweek.com · 60d ago · August 14th, 2026

2. update from gbhackers.com

   Trezor Shipping Provider Data Breach Exposes Personal Data of 13,689 Customers

   gbhackers.com · 60d ago · August 14th, 2026

   Hardware wallet manufacturer Trezor has recently disclosed a data breach at ShipMonk, a third-party shipping provider. This breach exposed the personal information of 13,689 customers. Importantly, Trezor’s internal systems, hardware wallets, private keys, wallet backups, and cryptocurrency holdings were not compromised. However, the leaked data poses significant risks to affected users, particularly regarding phishing and […] The post Trezor Shipping Provider Data Breach Exposes Personal Data of 13,689 Customers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   ShipMonk Data Breach Exposes 13,689 Trezor Customers’ Personal Information

   cyberpress.org · 60d ago · August 14th, 2026

   Hardware wallet maker Trezor has disclosed a third-party data breach affecting approximately 13,689 customers after unauthorized actors accessed systems operated by its shipping and fulfillment provider, ShipMonk. The incident exposed order-related personal data and poses a significant risk of targeted phishing , social engineering, and potential physical-world fraud against cryptocurrency holders. Trezor said ShipMonk notified the company of unauthorized access to systems holding customer information on August 10, 2026. ShipMonk Data Breach The investigation remains ongoing, but Trezor emphasized that the breach occurred within ShipMonk’s environment, not Trezor’s own infrastructure. The company stated that its devices, products, services, and customers’ wallet backups remain secure. The incident affected customers in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor initially identified orders received between May 10 and August 8, 2026, as being within the affected dataset. Of the 13,689 affected individuals, 11,742 had their names, email addresses, phone numbers, and shipping addresses fully exposed. A further 1,947 customers had a more limited set of information exposed: name, city, and email address. Trezor cautioned that this partially exposed group may include older orders and said it is verifying the precise timeframe with ShipMonk. While Trezor’s disclosure focuses on personal and fulfillment data, the operational implications a

4. update from cyberpress.org

   ShipMonk Data Breach Exposes Personal Data of 67,000 Additional Trezor Customers

   cyberpress.org · 39d ago · September 4th, 2026

   The newly identified records relate to orders processed during Trezor’s previous partnership with ShipMonk, from November 2019 to August 2021. The affected data includes customers’ full names, email addresses, phone numbers, shipping addresses, and order numbers, creating heightened risks of targeted phishing , phone scams, fraudulent mail, and potential physical-security threats. ShipMonk Data Breach Trezor said ShipMonk informed it on September 2 that the breach included older order data that had previously been believed to have been deleted. According to Trezor, the hardware wallet maker repeatedly obtained written assurances from ShipMonk that historical customer information had been deleted under contractual obligations, its data-retention policy, and prior communications. However, the data remained in ShipMonk’s systems and was subsequently accessed by an unauthorized actor. “This leaked data affects another approximately 67,000 US customers,” Trezor said in an update published September 4. Customers who did not receive an incident notification from help@trezor.io are not believed to be impacted.

5. update from gbhackers.com

   ShipMonk Data Breach Exposes Personal Data of 67,000 Additional Trezor Customers

   gbhackers.com · 39d ago · September 4th, 2026

   This significantly broadens the scope of an incident initially reported in August.