ShipMonk

Trezor

2026-09-10 21:28:55

Trezor says breach at email marketing provider led to phishing emails sent to 347,000 customers

Trezor said a breach at Brevo, the third-party marketing platform it uses for newsletters, allowed an unauthorized actor to send phishing emails to 347,000 customers using Trezor’s domain. The message, titled “Critical Security Alert: STM32 Entropy Vulnerability,” urged recipients to download an app and enter their wallet backup. Trezor said it took the domain down at the DNS level within 20 minutes, which limited exposure to 2,500 people who clicked the link before it was disabled. The company added that no other Trezor system was affected and that it has suspended its Brevo account to halt further distribution. The disclosure follows other recent incidents tied to Trezor’s third-party partners. Last month, the company said data from 11,742 customers was exposed after fulfillment partner ShipMonk was targeted. Last week, it said another 67,000 U.S. customers had names, email addresses, phone numbers, shipping addresses and order numbers leaked. Trezor also pointed to similar cases this year involving Ledger’s payment processor Global-e and a SafePal breach affecting about 39,798 customers’ order information.

890

Trezor

2026-09-10 07:15:14

Trezor says third-party email provider was breached in phishing campaign using fake STM32 flaw alert

Hardware wallet maker Trezor said on Sept. 9 that one of its third-party email service providers had been breached, allowing attackers to send phishing emails that appeared to come through legitimate Trezor-linked mail infrastructure. The messages used the subject line "Critical Security Alert: STM32 Entropy Vulnerability" and claimed that devices using STM32 microcontrollers faced a serious entropy flaw that could weaken wallet backup security. Trezor said the warning was fake, told users not to click any links or enter wallet information, and added that it had shut down the affected domain while investigating how access to systems tied to its legitimate domain was obtained. Users who posted email headers on Trezor’s official forum said the messages were sent via mailing.trezor.io, while some also reported that the emails passed SPF, DKIM, and DMARC checks. Independent security research said some malicious links initially redirected through a Trezor mail-tracking subdomain. Separate research pointed to Brevo as the platform involved, but Trezor has not officially named the breached vendor. The incident follows Trezor’s earlier disclosure that logistics partner ShipMonk had been breached, a case that later expanded to about 81,000 affected customers after the company found old order data had been retained in ShipMonk’s systems.

720

Trezor

2026-09-04 20:30:14

Trezor says breach was larger than first disclosed, with another 67,000 U.S. customers exposed

Hardware wallet maker Trezor said the customer data breach it disclosed last month was more extensive than it first reported. On Friday, the Prague-based company said another 67,000 U.S. customers were affected, with leaked records including names, email addresses, phone numbers, shipping addresses and order numbers tied to purchases made between November 2019 and August 2021. Trezor also said another 1,947 customers had their names, cities and email addresses exposed. The company said its third-party fulfillment partner, ShipMonk, had falsely assured Trezor in writing that customer data had been deleted from its systems. Trezor said it had repeatedly sought confirmation that the data was erased in line with contractual terms and its data policy, but the information remained in ShipMonk’s systems. The company had previously disclosed in August that 11,742 customers across the U.S., U.K., Sweden, Colombia, Brazil, Italy and Portugal were affected after unauthorized access hit ShipMonk’s systems. Trezor said it had emailed all impacted customers directly. Parent company SatoshiLabs told Bitcoin Magazine last month that it was investigating the incident. The report also pointed to prior breaches in the hardware wallet sector, including Ledger’s 2020 database leak and customer notices earlier this year tied to Ledger payment partner Global-e.

890

Trezor

2026-09-05 08:07:58

Trezor says ShipMonk breach exposed about 80,700 customer records, not private keys

Trezor said on Sept. 4 that a data breach tied to logistics partner ShipMonk was much larger than first disclosed, with another 67,000 U.S. customers affected and the total reaching about 80,700 people. The leaked data includes names, email addresses, phone numbers, shipping addresses, and order numbers, while some customers had only partial information exposed. Trezor said its own systems, hardware wallets, private keys, wallet backups, seed backups, and device data were not affected. The distinction matters because the breach did not expose wallet contents, but it did reveal who bought hardware wallets and where they live. That leaves customers open to targeted phishing, extortion, theft, and other real-world threats. Trezor said the newly identified records came from orders placed between November 2019 and August 2021 and should have been deleted. The company said it had repeatedly requested deletion under its contract and data policies and had received written confirmation, but the records remained in ShipMonk’s systems. Trezor is now preparing an anonymous shipping option, including a dedicated checkout flow, locker pickup, neutral packaging, generic sender information, and automatic deletion of shipping identifiers after delivery. The feature is expected in the EU in September 2026 and in the U.S. by year-end, though it will not undo the leak of the roughly 80,000 records already exposed.

870

Trezor

2026-09-04 13:35:39

Trezor says ShipMonk breach exposed 67,000 more US users, taking total above 80,000

Trezor said a data breach tied to its mailing partner ShipMonk was far larger than first disclosed, with another roughly 67,000 US users now identified as affected. That pushes the total number of impacted users to more than 80,000. The hardware wallet maker had previously said 13,689 customers were exposed after attackers infiltrated ShipMonk’s systems, and at the time pointed to a 90-day data retention policy as a factor that limited the scope. Trezor now says that policy was never actually enforced and the data was never deleted. The company said it had repeatedly requested and received written confirmation from ShipMonk that deletions had taken place in line with contractual terms and internal policy. Trezor told Protos it is still too early to say how it will respond to ShipMonk’s conduct, but said it is arranging an additional audit of the mailing partner. The company also said it is working to introduce anonymous delivery as soon as possible so customers can better protect personal information when placing orders.

830

Trezor

2026-09-04 10:20:39

Trezor Updates ShipMonk Breach: 67,000 More US Users Exposed

Trezor revealed that the data breach at its logistics partner ShipMonk was larger than initially reported, with an additional 67,000 US customers who ordered between November 2019 and August 2021 having their personal information exposed. The exposed data includes names, emails, phone numbers, shipping addresses, and order numbers. Trezor stated that its own systems remain secure and hardware wallets are safe, but affected users may face targeted phishing attacks. All impacted users have been notified individually. Trezor is accelerating the rollout of anonymous shipping services to reduce information exposure during order placement.

800

Trezor

2026-08-14 11:06:07

Trezor says 13,689 customers were exposed in ShipMonk breach as shipping label practices draw new scrutiny

Trezor disclosed on Aug. 13 that its logistics partner ShipMonk suffered unauthorized access to a system holding customer information, affecting 13,689 people. The exposed data fell into two groups: 11,742 customers had their full names, email addresses, phone numbers and full shipping addresses exposed, while 1,947 had their names, city and email addresses exposed. Trezor said its own systems, products and services were not compromised, and that hardware wallets, private keys and wallet backups were not part of the incident. The disclosure came two days after a user posted that the outer label on a domestically shipped Trezor Safe 3 package explicitly read "Trezor Safe 3 Bitcoin Only" instead of a generic product description. There is no confirmed direct link between the shipping-label complaint and the ShipMonk breach, but together they highlight the same problem: a hardware wallet may protect private keys, while purchase, fulfillment and delivery processes can still connect the device to a real-world identity. The episode has also fed a broader debate over hardware-wallet risk. Recent incidents involving Trezor, Coldcard and Ledger did not stem from the same failure point. Some relate to device or firmware security, while others involve third-party commerce, logistics or packaging exposure. For affected users, the most immediate concern is targeted phishing and social-engineering attempts that use real names, addresses, order details and device information to appear credible.

510

Trezor

2026-08-13 14:40:06

Trezor says ShipMonk breach exposed order data of 13,689 customers

Trezor said on Aug. 13 that a data breach at fulfillment partner ShipMonk exposed order-related personal information tied to 13,689 customers, while wallet devices, private keys, seed phrases, and Trezor’s own systems were not affected. According to the company, 11,742 customers had full records exposed, including names, phone numbers, email addresses, and shipping addresses. Another 1,947 customers saw partial exposure involving names, cities, and email addresses. The affected orders were created between May 10 and Aug. 8 and spanned the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor warned that the main follow-on risk is phishing, urging users to be cautious with unexpected calls, texts, or emails and never enter a wallet backup seed phrase online. The incident marks the first leak of customer phone numbers and addresses in Trezor’s 13-year operating history.

440