# ShipMonk Fulfillment Partner Breach Exposes Data of 13,689 Trezor Customers

> Trezor's third-party logistics provider ShipMonk suffered unauthorized access to systems holding customer order data, exposing full contact and shipping details for 11,742 customers and partial data (name, city, email) for 1,947 more across seven countries. Trezor's own devices, firmware, and infrastructure were not compromised, but the exposed PII creates elevated phishing, vishing, and impersonation risk against a population of confirmed hardware-wallet owners.

- **Published:** 2026-08-13T00:00:00Z
- **Last reviewed:** 2026-08-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2007
- **ID:** TL-2026-2007
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 10, 2026 (a Monday), ShipMonk — a third-party order fulfillment and logistics provider that stores and ships Trezor hardware wallets — notified Trezor that an unauthorized party had accessed systems containing customer order data. Trezor publicly disclosed the incident on August 13, 2026, stating that no device, private key, wallet backup, or Trezor-owned infrastructure was affected; the compromise was confined to ShipMonk's fulfillment systems.

The exposure affects 13,689 customers who placed orders shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal between May 10 and August 8, 2026 (the affected order window). Of these, 11,742 customers had full names, email addresses, phone numbers, and shipping addresses exposed, along with order numbers; 1,947 customers had a reduced data set of name, city, and email address exposed. Trezor attributes the relatively bounded scope to a 90-day data-retention policy with its fulfillment partners, which meant older order records had already been deleted or anonymized before the intrusion.

No attack vector, initial-access method, or attacker identity has been disclosed by either ShipMonk or Trezor. This is consistent with a third-party/vendor trust-relationship compromise (MITRE ATT&CK T1199) rather than a direct compromise of Trezor's own environment: the adversary gained access to sensitive customer records by reaching a trusted downstream processor rather than Trezor's core platform.

The practical risk from this breach is not asset theft (no device or seed material was exposed) but downstream social engineering: the leaked name/email/phone/address/order-number combination is exactly the material needed to make phishing emails, spoofed support calls, and fraudulent physical mail convincingly reference a victim's real, recent Trezor purchase. Trezor explicitly warned customers to expect "sophisticated phishing attempts" using the leaked information, including spoofed calls and impersonation of support or financial platforms.

This is not Trezor's first third-party data exposure. On January 17, 2024, an unrelated breach of Trezor's third-party support-ticketing portal exposed names/usernames and email addresses (and potentially phone numbers/addresses) of roughly 66,000 customers who had contacted support since December 2021; Trezor later confirmed 41 documented cases of attackers using that leaked data to send fraudulent "firmware validation" emails soliciting victims' 24-word recovery seed phrases, though no funds were reported stolen. The industry precedent is starker still: Ledger's June 2020 breach (via a misconfigured e-commerce API key) resulted in a December 2020 public dump of 272,000 customer records containing full names, postal addresses, and phone numbers, which directly fueled a wave of 2021 physical-mail scams — tampered "replacement" hardware wallets shipped to victims' real addresses with instructions to enter recovery seeds into a device designed to exfiltrate them. The ShipMonk breach reproduces the exact same data profile (name + address + order context) against the same class of victim (confirmed hardware-wallet owners), making that physical/vishing threat model directly applicable here even though no such attack has yet been reported against this specific dataset.

As a stated mitigation, Trezor announced it will roll out an "Anonymous Delivery" option — neutral packaging, locker pickup, and automatic post-delivery deletion of shipping data — to the EU by September 2026 and the US by the end of 2026.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1566 Phishing
- T1566.004 Spearphishing Voice
- T1213 Data from Information Repositories
- T1589 Gather Victim Identity Information
- T1589.002 Email Addresses
- T1598 Phishing for Information
- T1598.004 Spearphishing Voice
- T1585 Establish Accounts
- T1585.002 Email Accounts
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [Trezor ShipMonk Data Breach](https://cybersecuritynews.com/trezor-shipmonk-data-breach/)
- [Trezor Customer Data Exposed in Shipping Partner Breach](https://decrypt.co/375556/trezor-customer-data-exposed-in-shipping-partner-breach)
- [Trezor customer data exposed due to ShipMonk security breach, affecting users in 7 countries](https://www.chaincatcher.com/en/article/2282640)
- [Trezor customer data exposed due to ShipMonk security breach, affecting users in 7 countries](https://www.odaily.news/en/newsflash/509328)
- [Bitcoin News: Trezor customer data exposed in ShipMonk breach](https://x.com/BitcoinNewsCom/status/2087884174468251738)
- [Trezor support site breach exposes personal data of 66,000 customers](https://www.bleepingcomputer.com/news/security/trezor-support-site-breach-exposes-personal-data-of-66-000-customers/)
- [Trezor discloses phishing attack impacting 66,000 users](https://cryptobriefing.com/trezor-discloses-phishing-attack-impacting-66000-users/)
- [Addressing the July 2020 e-commerce and marketing data breach — A Message From Ledger's Leadership](https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach)
- [New Ledger breach didn't steal your crypto but exposed the one thing that leads criminals to your door](https://cryptoslate.com/new-ledger-breach-didnt-steal-your-crypto-but-it-exposed-the-one-thing-that-leads-criminals-to-your-door/)
- [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html)
- [MITRE ATT&CK T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
- [ShipMonk SOC 2 / Trust and Compliance](https://www.shipmonk.com/trust/soc-2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2007