Trezor Expands Scope of ShipMonk Breach, Reveals 67,000 More U.S. Customers Affected

Trezor, the maker of popular hardware cryptocurrency wallets, announced on September 4, 2026 that the data breach involving its fulfillment partner ShipMonk was far larger than initially disclosed. The company said the leaked files included older U.S. order records that should have been erased, adding roughly 67,000 customers to the list of those potentially exposed.

ShipMonk, a third‑party logistics firm that processes and ships products for a range of technology brands, suffered a cyber‑incident earlier this year that resulted in the unauthorized release of personal data. Initial reports indicated a limited set of recent orders, but Trezor’s latest assessment shows that historical records—some dating back several years—were also part of the compromised dataset.

According to the statement released by Trezor, the retained records contained names, mailing addresses, email addresses and, in some cases, partial payment information such as the last four digits of credit cards. No full financial details or private keys associated with the hardware wallets were believed to be part of the breach.

In response, Trezor has launched a comprehensive investigation in collaboration with independent cybersecurity experts and has begun notifying the affected customers. The company is offering free identity‑theft protection services, including credit monitoring and fraud alerts, to anyone whose data appears in the expanded list.

The incident highlights the growing risks that arise when hardware manufacturers outsource logistics to external providers. While Trezor maintains that the breach did not compromise the security of its wallets themselves, the exposure of personal identifiers could make targeted phishing attacks more plausible, especially against cryptocurrency users.

Regulatory bodies in the United States and the European Union have been alerted, and Trezor expects to cooperate fully with any inquiries. The firm also said it will review and tighten its data‑retention policies with all third‑party vendors to ensure that obsolete records are promptly destroyed in accordance with privacy laws such as GDPR and the California Consumer Privacy Act.

Industry analysts note that the incident may prompt other crypto‑related firms to reassess their supply‑chain security practices. The broader conversation about how much customer data should be shared with logistics partners is likely to intensify as the sector continues to expand.

For now, Trezor advises users to remain vigilant, monitor their accounts for suspicious activity, and follow the guidance provided in the breach notification emails. The company has not indicated a timeline for a full public report, but it pledged to release further details as the investigation progresses.