|

Trezor Provider ShipMonk Breach Exposed Order Data for 13,689 Hardware Wallet Customers

The breach hit 11,742 clients whose names, e mail addresses, cellphone numbers, and transport addresses have been all uncovered, plus 1,947 whose names, cities, and e mail addresses have been taken.

Order numbers have been included. Trezor mentioned the information got here from orders obtained between May 10 and August 8, 2026, and named the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal because the affected markets.

“Our programs weren’t compromised, and your Trezor machine is safe,” the corporate acknowledged, including that {hardware} wallets, non-public keys, and pockets backups weren’t affected.

A 90-day knowledge storage coverage, which Trezor mentioned it negotiated into its achievement companions’ phrases as nicely, saved older orders out of the uncovered set, however each affected buyer was contacted individually by e mail.

Phishing Warning Follows Address Leak

Trezor advised clients to deal with any communication that calls for fast motion or requests private info as “suspicious,” to verify claims towards official channels, and to by no means enter a pockets backup on an internet site or share it with anybody.

Its disclosure mentioned affected clients “may expertise a rise in phishing makes an attempt.” But it appears customers discovered that assertion cynical. “Phishing?? They have bodily addresses, you imbeciles,” wrote an X consumer posting as Chikun, in a reply that collected about 159 likes throughout the hour. Another reply referred to as the publicity “irl phishing.”

The phishing danger nonetheless tracks what adopted a comparable incident at a rival. CryptoPotato reported that scammers used order knowledge leaked from Ledger’s e-commerce associate Global-e to ship phishing emails claiming Ledger and Trezor had merged, pushing recipients to enter 24-word restoration phrases on a pretend website.

Yet Another Trezor Incident

Trezor mentioned it’s investigating and can publish updates on its weblog. The firm additionally talked about constructing an Anonymous Delivery choice, with impartial packaging, generic sender particulars, and computerized deletion of transport identifiers.

Not a simple time for being a Trezor buyer, as they’ve been reached via distributors twice earlier than. Attackers despatched phishing emails via a Trezor mailing listing compromised at MailChimp in 2022, pointing customers to lookalike obtain domains constructed to steal seed phrases.

Two years later, a breach of a third-party help ticketing portal uncovered names and e mail addresses for roughly 66,000 customers who had contacted Trezor Support since December 2021. Both of these uncovered contact particulars, however this one uncovered dwelling addresses throughout a number of nations.

The publish Trezor Provider ShipMonk Breach Exposed Order Data for 13,689 Hardware Wallet Customers appeared first on CryptoPotato.

Similar Posts