Trezor Breach Worse Than Reported: Another 67,000 US Customers Exposed

The recent disclosure from Trezor regarding an expanded data breach underscores the critical importance of supply chain security in the cryptocurrency hardware sector. Initially, Trezor reported that data from 11,742 customers across several countries had been exposed. However, the latest update reveals a significantly larger compromise, affecting an additional 67,000 U.S. customers. This escalation means that a total of nearly 80,000 customers have had sensitive personal information, including names, emails, phone numbers, and shipping addresses, leaked due to a lapse by a third-party partner.

ShipMonk

The core of the problem lies with ShipMonk, Trezor's third-party fulfillment partner. Trezor explicitly stated that despite repeated requests and written assurances confirming the deletion of customer data in line with their contract and data policy, ShipMonk failed to do so. This failure allowed an unauthorized party to access their systems, leading to the data exposure. The incident highlights the inherent risks associated with outsourcing critical operations, even when robust contractual agreements are in place, as the actual implementation of security protocols by third parties can be difficult to verify.

This situation creates a significant trust issue, not only for ShipMonk but also for Trezor, which relied on its partner's assurances. The discrepancy between the confirmed deletion and the actual retention of data points to either negligence or a severe breakdown in internal processes at ShipMonk. For customers, this means their personal information, entrusted to a reputable hardware wallet provider, was compromised through a vendor that did not uphold its end of the security bargain.

67,000 US Customers

The exposure of an additional 67,000 U.S. customers is particularly concerning due to the sheer volume and the nature of the data involved. The leaked information—names, emails, phone numbers, shipping addresses, and order numbers—provides a comprehensive profile that can be exploited by cybercriminals. This data can be used for highly targeted phishing campaigns, social engineering attacks, or even physical threats, where attackers might impersonate Trezor or other entities to trick users into revealing their seed phrases or other critical cryptocurrency credentials.

Orders made between November 2019 and August 2021 are specifically affected, indicating a prolonged period during which this sensitive data was vulnerable. The delay in discovering the full extent of the breach further complicates the situation, as affected customers may have been unaware of their increased risk for an extended period. This incident serves as a stark reminder that even with secure hardware, the surrounding ecosystem and supply chain can introduce significant vulnerabilities.

Ledger

This incident is not an isolated event in the hardware wallet industry. The article draws a parallel to a similar breach involving Ledger, another popular hardware wallet manufacturer, in 2020. In that instance, an unauthorized party accessed Ledger's e-commerce and marketing database, exposing over 1 million email addresses and personal contact data of nearly 10,000 customers. More recently, Ledger's payment partner, Global-e, also experienced a data breach that leaked sensitive customer data from its cloud systems.

These recurring incidents involving major hardware wallet providers and their partners underscore a systemic challenge within the crypto industry: while the hardware itself may be secure, the peripheral systems handling customer data often present weak points. The pattern suggests that cybercriminals are actively targeting these less-fortified areas to gain access to information that can then be used to compromise users' cryptocurrency holdings. This trend necessitates a re-evaluation of data handling practices and third-party vendor oversight across the entire sector.