On 4 September 2026, hardware wallet maker Trezor updated its disclosure of a breach at ShipMonk, its shipping and logistics provider. The incident, first announced on 13 August, had grown by about 67,000 US customers who ordered between November 2019 and August 2021. Trezor said that data should not have existed: its policy required deletion, and ShipMonk had repeatedly confirmed in writing that it was gone.
The breach was the vendor's. The size of it came down to a deletion promise nobody had verified.
What's affected
From Trezor's disclosure and FAQ:
- Vendor: ShipMonk, which stores Trezor products and ships orders.
- Timeline: ShipMonk told Trezor about unauthorized access on 10 August 2026. Trezor disclosed on 13 August. On 2 September Trezor learned the breach was larger, and it published the update on 4 September.
- First group: Orders placed between 10 May and 8 August 2026 in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal. Trezor lists 11,742 customers with full exposure and 1,947 with partial exposure.
- Second group: About 67,000 US customers who ordered between November 2019 and August 2021.
- Data, full exposure: Name, email, phone number, shipping address and order number.
- Data, partial exposure: Name, city and email.
- Not affected: Trezor says its own systems, devices, private keys and wallet backups were not compromised.
On deletion, Trezor says its policy requires customer data to be deleted or anonymized 90 days after delivery. It wrote: "We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems."
Trezor has not published how ShipMonk was breached. BleepingComputer reported that breach notification emails it saw said attackers exploited a vulnerability in the Metabase analytics platform, and linked it to a wider campaign against Metabase instances that also hit Framework and Tally. BleepingComputer also reported that ShipMonk received extortion emails. Neither Trezor nor ShipMonk has confirmed those details in the sources cited here.
How to check if you're exposed
If you are a Trezor customer who ordered in either window, assume your name and shipping address are known. Trezor's warning is to expect phishing by email, phone and post, and never to enter your wallet backup anywhere but your device.
For companies, the real check is whether your vendors hold data you think they deleted.
- List vendors that receive personal data and the retention terms you agreed. If there is no retention term in the contract, you have no deletion promise to check.
- Plant canary records. Create a unique email address for each vendor, for example a dedicated alias per vendor, and push one synthetic record through each integration. If that address ever receives mail after the agreed retention period, or shows up in a breach dataset, you know who kept it.
# Generate a unique canary address per vendor using plus-addressing
for v in shipmonk-example crm-example helpdesk-example; do
echo "privacy+canary-${v}-$(date +%Y%m)@yourcompany.example"
done
- Ask for deletion evidence, not a yes. A deletion log, a record count before and after, or a query result showing the old date range is empty.
- Check the vendor's own tools. Analytics and reporting platforms connected to a vendor's production database often keep their own copies. Ask whether deletion covers backups, data warehouses and BI tools.
What to do now
- Add verifiable retention terms to every data processing agreement. State the period, the systems in scope (including backups and analytics copies) and the evidence the vendor must provide.
- Schedule deletion audits. Once a year, ask each vendor that holds customer data to show the oldest record they hold for you. If it predates your retention period, escalate.
- Minimize what you send. A shipping provider needs a name and address to deliver a parcel. It may not need an email address or order history beyond the delivery window.
- Run canaries continuously. One synthetic record per vendor per quarter costs almost nothing and gives you independent evidence.
- Prepare for phishing after any vendor breach. Trezor has been a target of follow-on phishing before. Warn customers early with specific guidance on what you will never ask for.
Why it matters
Most vendor questionnaires ask whether a vendor has a retention policy. Fewer ask for proof the policy runs. Trezor did the right thing on paper: it had a 90-day deletion rule and it obtained written confirmation. The data was still there, and it more than quadrupled the number of people affected.
A written promise is a control you cannot test. Canary records and deletion evidence are controls you can.
Try it yourself
Pick one vendor that has held your customer data for more than a year. Ask them for the date of the oldest record they still hold for you. Compare it with your contract. If the answer is older than your retention period, or they cannot tell you, open a finding.
Click through it at your own pace, or open it full screen.
Quick check
Why did the number of affected customers grow?
Because ShipMonk still held order data for about 67,000 US customers from November 2019 to August 2021, which Trezor says should have been deleted under its policy and which ShipMonk had confirmed deleting.
Were Trezor's systems or wallets compromised?
Trezor says no. Its systems, devices, private keys and wallet backups were not affected.
Has the attack vector been confirmed?
Not by Trezor or ShipMonk in their public statements. BleepingComputer reported that notification emails cited a Metabase vulnerability.
