Trezor: ShipMonk breach exposed 67,000 more US customers
Trezor posted that ShipMonk failed to delete order records, exposing names, emails, phone numbers, shipping addresses and order details for 67,000 US customers who ordered Nov 2019–Aug 2021.
Hardware wallet maker Trezor posted on X that a data breach at shipping provider ShipMonk exposed personal details for an additional 67,000 US customers who placed orders between November 2019 and August 2021. The company said the latest update from ShipMonk shows the records were not deleted as previously believed, leaving full order details exposed.
Trezor noted the exposed fields include names, email addresses, phone numbers, shipping addresses and order specifics. The company reported its own systems were not compromised and identified the exposure as originating in ShipMonk’s records rather than in Trezor’s infrastructure.
The wallet maker blamed ShipMonk for failing to remove the data after receiving written assurances that the records had been deleted. Trezor warned that the exposed information could enable targeted phishing and social engineering campaigns that impersonate support to trick users into revealing seed phrases or approving malicious transactions.
The newly disclosed 67,000 affected customers increases an earlier estimate from August that put the number of US users exposed through ShipMonk at about 14,000. Separately, Trezor reported in January 2024 that roughly 66,000 users who contacted the company’s support since December 2021 could be at risk from different sets of support-related records.
Industry data shows impersonation-based scams have accounted for a large share of recent crypto losses; a security firm reported those scams made up $306 million of $482 million in crypto-related losses in the first quarter of the year. In a July incident, an investor lost nearly $1 million after signing a malicious token approval transaction on Ethereum.
Trezor’s post did not provide details about notification timelines or remediation steps for the newly identified customers. The company urged users to be wary of unsolicited messages and to avoid sharing seed phrases or approving transactions in response to requests that claim to come from support.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
