Back
Trezor says ShipMonk breach exposed customer order data in seven countries

Trezor says ShipMonk breach exposed customer order data in seven countries

A breach at fulfillment partner ShipMonk exposed order-linked personal data for about 14,000 Trezor customers in seven countries, prompting phishing warnings while Trezor said its own systems and hardware wallets were not compromised.

Fact Check
The primary source, Trezor's official blog post, and Trezor's official X announcement both confirm every element of the claim: a breach at fulfillment/shipping provider ShipMonk exposed personal order data for 13,689 customers (11,742 full + 1,947 partial) across the US, UK, Sweden, Colombia, Brazil, Italy and Portugal; Trezor warns of phishing while stating its own systems, devices and wallet backups were not compromised. Independent reporting by Decrypt and ChainCatcher corroborates the figures and country list. There is no conflicting evidence.
Summary

Trezor said a data breach at fulfillment partner ShipMonk exposed customer information tied to orders received between May 10 and Aug. 8, 2026 in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal. The company said 13,689 customers were affected in total, or about 14,000: 11,742 had names, email addresses, phone numbers and shipping addresses exposed, while another 1,947 had names, cities and email addresses compromised, with order numbers also included. Trezor said its own systems and devices remain secure, warned affected users about elevated phishing risk, and said no stolen data had surfaced for sale so far.

Terms & Concepts
  • Phishing: Fraudulent messages or outreach designed to trick users into revealing sensitive information, such as wallet recovery phrases, or transferring assets.
  • Hardware wallet: A physical device used to store cryptocurrency private keys offline for added security.
  • Anonymous Delivery: A planned Trezor shipping option intended to reduce retained customer information through measures such as locker collection, neutral packaging and deletion of shipping identifiers after delivery.