Loading story…
Trezor disclosed that unauthorized access at third-party logistics provider ShipMonk exposed customer order data for 13,689 hardware wallet buyers, affecting recent deliveries across the U.S., U.K., Sweden, Colombia, Brazil, Italy, and Portugal. The exposed information included full names, email addresses, phone numbers, and shipping addresses for 11,742 customers, while 1,947 others had more limited data exposed, such as name, city, and email address. Trezor said ShipMonk notified it of the incident after attackers accessed systems containing order records tied to shipments delivered between May 10 and Aug. 8, 2026.
Trezor said its own infrastructure, wallets, devices, and firmware were not compromised, but warned affected customers to expect phishing, impersonation, and possible physical-security risks because the leaked data links identities to hardware wallet purchases. The company said its 90-day data retention policy limited the scope because older records had already been deleted or anonymized, and it has notified impacted users by email while working with ShipMonk as the provider secures and hardens affected systems. Trezor also said it plans to roll out an Anonymous Delivery option, first in the EU and later in the U.S., to reduce future customer exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-10, ShipMonk informed Trezor that unauthorized access had occurred in systems containing customer data. The affected systems held order-fulfillment information for Trezor customers.
ShipMonk told affected customers that attackers exploited a vulnerability in the third-party analytics platform Metabase to access data tied to ShipMonk and its customers. ShipMonk said Metabase notified it on 2026-08-06, and that Metabase patched the flaw and invalidated active sessions.
The customer records later exposed in the ShipMonk incident were tied to orders delivered between 2026-05-10 and 2026-08-08. Trezor said the affected population consisted of recent shipments within that period.
Trezor announced plans for an Anonymous Delivery option intended to reduce future exposure of customer shipping data. The planned feature includes dedicated checkout, locker pickup, neutral packaging, generic sender details, and deletion of shipping identifiers after delivery.
Trezor said ShipMonk had secured and hardened the affected systems after the breach. Trezor also said it was working with ShipMonk to investigate what happened and determine exactly which data was accessed.
Trezor said it notified affected customers by email from help@trezor.io and warned them to expect phishing, spoofed calls, fraudulent letters, and impersonation attempts. The company said customers who did not receive the notification email were not part of the exposed set.
Trezor said 11,742 customers had names, email addresses, phone numbers, and shipping addresses exposed, and an additional 1,947 customers had names, home cities, and email addresses exposed. It also said some of the additional group may have placed orders before 2026-05-10, indicating the exposure may extend beyond the previously identified shipment window.
Trezor disclosed that unauthorized access at third-party logistics provider ShipMonk exposed fulfillment-related customer data for about 13,689 customers. Trezor said its own infrastructure, wallets, devices, and firmware were not compromised.
SecurityWeek reported that the extortion group ShinyHunters claimed responsibility for an attack on Metabase and leaked data allegedly stolen from Metabase on Wednesday. This introduced a new attribution-related development connected to the ShipMonk/Trezor exposure, though responsibility for the ShipMonk breach itself remained unconfirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourcethedefiant.io
Open sourcecybersecuritynews.com
Open sourcetrezor.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed order information for **39,798** hardware-wallet customers who placed orders between **March 2, 2025** and **April 11, 2026**. The exposed data included names, email addresses, shipping addresses, phone numbers, and purchase details, while **seed phrases, private keys, wallet passwords, payment card data, bank account information, and government IDs were not exposed**. SafePal said it first received a report consistent with the issue in early May 2026, initially treated it as isolated, and later completed a broader review and rebuild of its order-processing environment. The company also said a separate configuration error broke a scheduled data-cleanup process between September 2025 and April 2026, causing customer records to remain far longer than its stated retention period and expanding the scope of exposed data. SafePal has since purged personal data from active e-commerce servers, reduced retention in the order-processing environment to 90 days, launched a status checker, and engaged an independent third party to review the fix. The stolen data is reportedly being offered for sale on a cybercrime forum, and SafePal warned that attackers have already used real order details in targeted phishing and social-engineering calls and emails against affected customers.
Aug 17, 2026
Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to **3,834,294 individuals**. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the **ShinyHunters** extortion group, which claimed to have stolen about **9 million records** and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information. Medtronic said it found **no impact** on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering **24 months** of credit monitoring, dark web monitoring, and identity theft recovery services.
Jul 8, 2026
**Tenga** disclosed a data breach after an attacker gained unauthorized access to a single employee’s professional email account, allowing visibility into the mailbox contents and enabling outbound spam/phishing to the employee’s contacts, including customers. The exposed information potentially included customer **names, email addresses, and historical email correspondence**, which may have contained **order details** or customer service inquiries; Tenga said a forensic review determined the incident affected **approximately 600 U.S. customers**. Tenga characterized the incident as localized and limited in scope, stating its broader systems and databases outside the U.S. were not impacted and that **no Social Security numbers, payment card data, billing information, or store passwords** were compromised. Post-incident actions described included resetting the affected employee’s credentials and implementing or expanding **multi-factor authentication** across systems; customers were advised to remain vigilant for suspicious emails and consider changing passwords as a precaution, particularly for messages appearing to come from the impacted employee account.
Jun 29, 2026