Trezor said a breach at logistics provider ShipMonk exposed contact and order data for approximately another 67,000 U.S. customers, expanding an incident initially disclosed as affecting 13,689 people. The newly identified records cover orders placed from November 2019 through August 2021 and include names, email addresses, phone numbers, shipping addresses and order numbers. The two disclosed groups imply roughly 80,689 affected customers, although Trezor has not published a consolidated figure or underlying data showing whether the groups overlap. The records remained at ShipMonk despite repeated written assurances that they had been deleted under Trezor's 90-day delivery-data policy. The breach did not affect Trezor's wallet systems, devices, recovery seeds, private keys or customer funds, but the combination of a person's identity, location and hardware-wallet purchase could support phishing, fraud or physical targeting. The initial unauthorized access was attributed by a ShipMonk notification, as reported by BleepingComputer, to a vulnerability in Metabase, whose August zero-day could enable an administrator-linked session and bulk table downloads. Trezor said it emailed every newly affected customer and advised users never to share a wallet backup or enter it on a website.