ShipMonk, the logistics company that handles shipping for Trezor, experienced a data breach. On August 10, ShipMonk notified Trezor of unauthorized access to its systems, and on August 13, the company disclosed details of the incident.
The breach affected around 13,689 customers in total. The attacker obtained full details for 11,742 people, including their name, email address, phone number, and shipping address. For another 1,947 customers, the exposed information included their name, city, and email address.
Which Orders Were Affected
The incident affected orders shipped to the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal between May 10 and August 8, 2026. ShipMonk stored the information needed to deliver orders, including customers’ names, addresses, phone numbers, email addresses, and order numbers.
Trezor limits the retention period for order data to 90 days. As a result, older records had already been deleted or anonymized by the time of the attack, which limited the scale of the incident.
The company emphasized that the attacker did not gain access to Trezor’s systems, and that the company’s devices and services were not affected. The main risk for customers is phishing attacks, in which attackers could use real names, phone numbers, and addresses exposed in the breach.