Trezor, the firm behind the first-ever hardware wallet, has reported a data breach at its shipping provider, ShipMonk, which exposed sensitive order information pertaining to thousands of users.
According to a message Trezor shared on X on August 13, ShipMonk notified the company on August 10 that an unauthorized party had gained access to customer data.
The incident potentially affected approximately 13,689 global customers who received an order within the 90 days prior to August 8, 2026, with 11,742 of them having their full names, email addresses, phone numbers, and shipping addresses exposed.
“Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days prior to August 8th, 2026,” Trezore wrote.
The incident marks the first time that a breach has exposed customer phone numbers and shipping addresses since Trezor was founded back in 2013 .
Trezor data breach raises phishing attack concerns
Trezor stressed that its own systems were not compromised, adding that its hardware wallets remain secure. However, the company warned that the leaked information could be used to conduct more convincing phishing attacks.
“Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts. NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels,” the message continued.
Fortunately, the breach was limited by Trezor’s 90-day data retention policy, which requires fulfillment partners to delete or anonymize order-related customer information after three months. As a result, older order data was no longer in ShipMonk’s systems at the time of the breach.
Trezor further stated that it is working with ShipMonk to determine exactly what happened and what information was accessed. On its own end, ShipMonk has reportedly secured the affected systems and implemented additional security measures.
Featured image via Shutterstock
