Trezor announced on August 13, 2026, that its third-party fulfillment partner, ShipMonk, experienced a data breach due to unauthorized access to systems containing customer order data.
The ShipMonk data breach exposed the personal information of 13,689 Trezor customers who received orders between May 10 and August 8, 2026.
Trezor stated that its own internal systems, devices, private keys, and wallet backups were not compromised in the ShipMonk breach.
A total of 11,742 Trezor customers had their full names, email addresses, phone numbers, and physical shipping addresses exposed in the ShipMonk breach.
Trezor warned that the exposed customer information increases the risk of sophisticated phishing campaigns, fake phone calls, and fraudulent letters.
ShipMonk informed Trezor of the unauthorized system access on August 10, 2026.
The ShipMonk breach affected Trezor customers who had orders shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal.
Trezor urged customers to never enter their wallet backup or seed phrase on any website or share it with anyone.
Trezor notified affected customers via email, stating that customers who did not receive an email from help@trezor.io were not impacted.
Trezor attributed the limited scope of the breach to its policy requiring fulfillment partners to delete or anonymize customer order data 90 days after delivery.
Rival hardware wallet manufacturer Ledger experienced a similar data breach in January 2026 involving its third-party e-commerce partner, Global-e, which exposed customer contact details.
Trezor stated that the ShipMonk breach is the first time in the company's 13-year history that customer phone numbers and shipping addresses have been exposed.
In response to the breach, Trezor is accelerating the launch of an Anonymous Delivery option, targeting the European Union by September 2026 and the United States by the end of 2026.
Ledger previously suffered a major data breach in 2020 that exposed the personal contact data of nearly 272,000 customers, leading to long-term phishing and extortion campaigns.
