Trezor Says Data Breach Was Worse Than Reported, Exposing 67,000 More U.S. Customers
Shipping partner failed to delete data despite assurances
Trezor, a maker of hardware wallets used to store cryptocurrencies like Bitcoin securely, said on September 4 that its data breach affects far more customers than originally thought.
The company found that another 67,000 U.S. customers had their names, email addresses, phone numbers, shipping addresses, and order numbers leaked. This data comes from orders placed between November 2019 and August 2021. Another 1,947 customers also had their names, cities, and emails exposed.
The breach was traced to Trezor's third-party fulfillment partner, ShipMonk. Trezor stated that the company repeatedly received written assurance that its customer data had been deleted from ShipMonk’s systems, in line with their contract. However, ShipMonk had not actually erased the data.
Original breach affects customers across seven countries
Trezor first announced the breach in August after discovering unauthorized access to ShipMonk's systems. At that time, the company reported that data from 11,742 customers had been exposed.
Those affected customers were located in the U.S., UK, Sweden, Colombia, Brazil, Italy, and Portugal. The leaked information included names, emails, phone numbers, and shipping addresses.
Company response and investigation
Trezor said it has directly emailed all customers involved in the breach to inform them. Its parent company, SatoshiLabs, told Bitcoin Magazine in August that it was investigating the incident.
Neither Trezor nor ShipMonk responded to requests for comment immediately following the September update.
Similar breaches have targeted crypto hardware makers
Data targeting is not new for hardware wallet manufacturers. In 2020, the company Ledger reported that an unauthorized party accessed its database, leaking over 1 million email addresses and contact data for nearly 10,000 customers. Earlier this year, customers also reported data leaks linked to Global-e, Ledger’s payment partner.
