Trezor Warns 14,000 Customers of Shipping Data Breach at Fulfilment Partner

The breach at ShipMonk

The exposure happened at ShipMonk, a third-party logistics provider, not inside Trezor's own systems. That distinction matters for a company whose product is built around keeping private keys offline. The data that leaked was shipping information tied to physical orders, not anything connected to the wallets themselves.

Trezor hasn't said how the breach happened or when it was discovered. What it has confirmed is that the affected data was limited to personal shipping details for roughly 14,000 customers.

What wasn't touched

The key line for users: no crypto funds, no wallet credentials. Hardware wallets are designed so keys never leave the device, and Trezor says that held up here. The breach hit the logistics side of the business, not the security side.

That's the message the company is leaning on in its notification. For customers, the practical concern is more mundane — a name and address in the wrong hands can be used to make phishing messages look convincing, especially when they reference a real incident.

What the notice means

Trezor's notification went to the affected group directly. Anyone who received it should treat unsolicited messages referencing the breach with suspicion — the standard playbook for scammers is to piggyback on real events and ask for recovery seeds or passwords. Legitimate companies don't ask for those.

The open question is how ShipMonk's systems were breached and whether the exposed data goes beyond what Trezor has disclosed. The company hasn't said when it learned of the incident or what steps ShipMonk has taken since. For now, the affected customers have been told, and the scope appears contained to shipping data.

Trezor has alerted roughly 14,000 customers that their personal shipping data was exposed in a breach at ShipMonk, the fulfilment partner the hardware wallet maker uses to process orders. The company said no crypto funds or wallet credentials were compromised. Notices went out this week.

The breach at ShipMonk

The exposure happened at ShipMonk, a third-party logistics provider, not inside Trezor's own systems. That distinction matters for a company whose product is built around keeping private keys offline. The data that leaked was shipping information tied to physical orders, not anything connected to the wallets themselves.

Trezor hasn't said how the breach happened or when it was discovered. What it has confirmed is that the affected data was limited to personal shipping details for roughly 14,000 customers. That's a small slice of the user base, but for a hardware wallet maker, any breach notification carries weight — the product's entire pitch is that your keys stay yours.

What wasn't touched

The key line for users: no crypto funds, no wallet credentials. Hardware wallets are designed so keys never leave the device, and Trezor says that held up here. The breach hit the logistics side of the business, not the security side.

That's the message the company is leaning on in its notification. For customers, the practical concern is more mundane — a name and address in the wrong hands can be used to make phishing messages look convincing, especially when they reference a real incident.

What the notice means

Trezor's notification went to the affected group directly. Anyone who received it should treat unsolicited messages referencing the breach with suspicion — the standard playbook for scammers is to piggyback on real events and ask for recovery seeds or passwords. Legitimate companies don't ask for those.

The open question is how ShipMonk's systems were breached and whether the exposed data goes beyond what Trezor has disclosed. The company hasn't said when it learned of the incident or what steps ShipMonk has taken since. For now, the affected customers have been told, and the scope appears contained to shipping data.