Security1 distinct publisher3 min readPublished
The records cover orders placed between November 2019 and August 2021, years past the 90-day deletion window Trezor advertises. Trezor says it held repeated written confirmation from ShipMonk that the data was gone.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Deletion was the only control that could have helped here. ShipMonk was breached through CVE-2026-72898, a SQL injection flaw in Metabase rated CVSS 10.0 and exploited as a zero-day [8]. There was no patch to apply that day and no window to beat. Whatever sat in that Metabase instance was reachable, and Holborn says what sat in it was Trezor customer order detail [14]. The size of this breach was therefore fixed before the exploit ran, by which records were still there.
Trezor's two disclosures now total 80,689 customers: 13,689 announced last month, 67,000 on Friday [15]. The first group falls inside Trezor's stated retention window, which it says is the shortest period covering delivery, returns and any refund or replacement [6][7]. The second does not. The newest orders in the exposed set date to August 2021, so under a 90-day policy the last of them should have been deleted or anonymised around November 2021; ShipMonk reported the intrusion on August 10, 2026, roughly four years and nine months later [17]. That makes 83 percent of Trezor's known exposure data that both parties had agreed in writing no longer existed [16].
Trezor says it repeatedly requested and received written assurance of deletion, in line with its contract and data policy [4]. That is where the record stops. Neither Trezor's statement nor Holborn's account says whether Trezor held audit or sampling rights over ShipMonk's systems, whether any confirmation was ever tested against a live query, or whether the confirmations were false when written or merely scoped to a system that was not the reporting copy. An attestation that names a dataset rather than the stores holding it is satisfied by deleting one of them. There was a prior signal: Trezor said the 1,947 customers whose exposure was limited to names, cities and email addresses may include older orders [18].
Holborn, an enterprise blockchain security firm, attributes the intrusion to the ShinyHunters extortion gang and says the same Metabase flaw was used against several of the platform's customers to steal data and extort [9][12]. Both points rest on Holborn alone. ShipMonk has said nothing publicly, and the account that it has secured the affected systems and improved its security carries no named attribution [10][11].
For the 67,000, the exposure is a name tied to a phone number, a shipping address and a hardware wallet order [2]. Trezor warns the data supports scam emails, fraudulent calls and letters, and potentially physical risk, and says it has notified affected customers directly [13]. The wallets themselves are unaffected [3]. Those addresses were current between 2019 and 2021, and the share still valid is now in an extortion crew's hands.
Ranked by verification strength, evidence, and original report placement.
Trezor disclosed on Friday that another 67,000 customers in the U.S. were impacted by a breach at its shipping provider ShipMonk.
The exposed information includes customer names, email addresses, phone numbers, shipping addresses and order numbers for orders placed between November 2019 and August 2021.
Trezor said the breach does not affect the security of the company's hardware wallets.
Trezor said that throughout its entire relationship with ShipMonk it repeatedly requested and received written assurance confirming deletion of the data, in line with its contract, data policy and past communications, and that it was very disappointed the data was not deleted in ShipMonk's systems.
Trezor said ShipMonk informed it of a breach on August 10, 2026, following unauthorized access to ShipMonk's systems.
The 67,000 figure is in addition to 13,689 customers Trezor disclosed last month as having had data fully or partially exposed; Trezor said at the time that the breach was limited during its 90-day data storage policy.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 5, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
invest
Order data ShipMonk promised to delete pushes Trezor's breach count to 80,7001 distinct publisher
security
CISA sets August 14 clock on Metabase and Cisco bugs, August 25 for the Windows SYSTEM flaw2 distinct publishers
invest
Fulfilment breach exposes data of 13,689 Trezor customers, opening door to phishing1 distinct publisher
security
A North Korean IT worker got hired by a federal agency. Vetting is a security control now.1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One outlet, one company's account
Every figure, date and reassurance in this story traces back to Trezor's own statement as relayed by The Hacker News. No second newsroom has published on it, and ShipMonk, the company whose systems were breached, has said nothing that could confirm or contradict the account. The CVE and its 10.0 rating are checkable in principle, but the link from that flaw to these particular records rests on Holborn, and the ShinyHunters attribution arrives hedged as something the gang is said to have done.
Counted people, uncounted merchants
The harm here is enumerated rather than modelled: 13,689 customers in the first disclosure, 67,000 in the second, all notified directly according to Trezor, with the fields and order dates specified. What nobody has enumerated is the rest of the blast radius. Holborn says the attackers reached several ShipMonk customers through the same Metabase flaw, and not one of those other merchants is named or counted in this reporting.
Told more mildly than the dates warrant
Nothing in this coverage is inflated. Trezor's line that wallet security is untouched is accurate and also beside the point, and the reporting passes it along without pressing the retention question behind it. The strongest fact available sits in the arithmetic rather than the text: under the 90-day policy Trezor advertises, the newest exposed orders should have been gone around November 2021, nearly five years before the provider reported the break-in, and 83 percent of the total exposure comes from records Trezor says it held written confirmation were deleted.
Blame moves away from both speakers
Two parties talk in this story and each benefits from where responsibility settles. Trezor quotes its contract and its deletion requests, which places the failure squarely with its provider and protects the retention promise it markets to privacy-conscious buyers. Holborn, an enterprise security firm, draws the lesson that organisations need complete visibility into third-party risk, which is the work it sells. ShipMonk, the party with the clearest reason to stay quiet, has not commented, and the credit it receives for securing systems and improving security appears with no named source behind it.
Firm on the admission, soft on the cause
The load at the centre of this story is a first-party admission that cuts against the teller's interest: Trezor conceding that records it had been assured were deleted were taken from its provider. Admissions of that shape rarely shrink. The surrounding detail is looser, and the attacker identity, the remediation claim and the number of other merchants caught in the same Metabase instance could all move the moment ShipMonk says anything at all.