Hardware wallet manufacturer Trezor reported that the data breach involving logistics partner ShipMonk is larger than previously disclosed: approximately 67,000 U.S. customers' names, emails, phone numbers, shipping addresses, and order numbers from orders placed between November 2019 and August 2021 have been fully exposed. The company stated that it has emailed affected individuals, and those who did not receive an email are not included.

When first disclosed on August 13, the breach affected orders from the U.S., U.K., Sweden, Colombia, Brazil, Italy, and Portugal within 90 days, with 11,742 individuals fully exposed and 1,947 partially exposed. ShipMonk experienced unauthorized access around August 8 and notified Trezor on the 10th. Trezor stated that contracts and data policies require the deletion of old orders, and it received written confirmations multiple times, but the other party's system did not actually delete the data. Trezor's own systems and devices were not compromised, and recovery phrases and private keys are not stored in the logistics database. The company will expedite the launch of anonymous shipping and warns against phishing emails, calls, letters, and personal safety risks, advising not to show wallet backups or input them on websites.

The addresses of hardware wallet buyers overlap with the "holding cold wallet" label, creating targeted phishing and home invasion risks. Amazon's channel was not included in this batch due to self-fulfillment. Trezor stated this is the first time since its founding in 2013 that phone numbers and addresses have been exposed.

The buyers are users who require physical isolation of keys, while the sellers are hardware manufacturers that outsource fulfillment to third-party logistics. The incident was driven by the logistics provider's supplementary reporting of historical data. Beneficiaries are those using anonymous shipping and self-built fulfillment, while those under pressure are left with a physical address book that can be located.

Source: Public Information