Trezor stated on Friday that an additional 67,000 U.S. customers were caught in the ShipMonk breach initially disclosed last month. The exposed records cover orders placed between November 2019 and August 2021, including names, phone numbers, and home addresses. Trezor emphasized that it had repeatedly received written confirmation from ShipMonk that this data had been deleted in accordance with their contract and data policy.
When the breach was first revealed in August, Trezor attributed its limited scope to a 90-day deletion policy negotiated with its fulfillment partners. However, the count has now risen from 13,689 to approximately 80,700, weakening that claim. All affected customers are based in the U.S. and placed orders within the specified timeframe, meaning some records are nearly seven years old.
Trezor clarified that its own systems were not breached, and devices, private keys, and wallet backups remain secure. The primary danger lies in the exposure of confirmed hardware wallet owners' personal details, which increases risks of physical security threats, fake communications, and fraud. The company warned customers not to share wallet backups or enter them into websites.
This incident follows similar attacks in February, where owners of Trezor and Ledger wallets received forged letters featuring holograms and QR codes demanding activation of a fictitious security check. Cybercrime consultant David Sehyeon Baek noted that stolen data containing names and addresses signals that attackers can locate victims, and such data remains useful for years as people rarely change contact information or move frequently.
The breach traces back to a critical SQL injection flaw in the analytics tool Metabase, disclosed on August 6, which allowed unauthenticated attackers to steal database credentials. Other companies, including laptop maker Framework and form builder Tally, were also affected. ShipMonk has reportedly received extortion emails linked to the ShinyHunters group, though this attribution remains unconfirmed.
In response, Trezor is working to implement anonymous delivery options as quickly as possible, including locker pickup, neutral packaging, and generic sender details, allowing buyers to avoid providing home addresses.