Trezor Confirms ShipMonk Data Breach Exposed 67,000 Additional US Customers

Trezor disclosed that a ShipMonk data breach — caused by exploitation of a critical SQL injection zero‑day in Metabase — exposed order records spanning 2019–2026, increasing the impacted customer count to over 80,000. Exposed fields include names, emails, phone numbers, shipping addresses and order numbers; Trezor systems and wallet backups were not compromised, but attackers can use the PII for phishing and physical‑security attacks. Affected customers were notified and Trezor plans shipment privacy mitigations.