Hardware Wallet Trezor Discloses Breach of 14,000 User Records Through Shipping Vendor

Shipping Partner Breach Exposes Customer Data

Hardware wallet manufacturer Trezor disclosed that customer information belonging to roughly 14,000 users was compromised through ShipMonk, the company’s shipping and fulfillment provider. The exposure affected customers across multiple regions including the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. The breach occurred during the period spanning from May 10 through August 8, according to Trezor’s official announcement.

Scope of Exposed Information

The data exposure impacted two separate groups of customers with different levels of information breached. The majority of affected customers—approximately 11,742 individuals—had their name, physical address, phone number, and email address exposed in the incident. A smaller subset of approximately 1,947 users had their name, city, and email address compromised, representing a less extensive exposure for this group.

Wallet Security Remains Uncompromised

Trezor emphasized that the breach did not extend to its core systems or infrastructure. The company stated clearly that customer devices, private keys, and backup information all remain secure and were never part of the exposed data. While the breach itself did not affect wallet security, Trezor warned that customers could now face increased risk from sophisticated phishing attempts that leverage the exposed personal information for social engineering attacks.

Scammers now possess enough information to craft convincing fake communications, including fraudulent emails, phone calls, physical mail, and messages impersonating legitimate financial institutions, cryptocurrency exchanges, or even Trezor itself. This technique of combining personal data with targeted deception represents a significant threat vector for compromised users.

Growing Pattern of Supply Chain Incidents

This latest incident represents another example of security risks extending beyond direct platform vulnerabilities. Trezor disclosed a previous incident in January 2024 where approximately 66,000 users faced potential phishing exposure after their information was accessed through the company’s support contact channels. The recurring nature of such breaches highlights the broader supply chain risks facing even major hardware wallet providers, where third-party vendors can become attack vectors.

Cryptocurrency users should remain vigilant against various deception tactics employed by threat actors, including fraudulent communications through multiple channels—emails, text messages, voice calls, physical mail, and impersonation of family members or authority figures. With personal data now in the wild, affected Trezor customers should exercise heightened caution when responding to unsolicited communications requesting account access or financial information. This incident underscores why operational security awareness remains as critical as technical wallet security for cryptocurrency users.

Source: Trezor, via Cointelegraph. Not financial advice.