Trezor has confirmed that a breach at logistics partner ShipMonk exposed personal information belonging to more than 13,000 customers who bought its cryptocurrency hardware wallets. The incident matters because the data could enable targeted phishing and potentially expose crypto holders to physical-security risks, despite Trezor saying its own systems and devices were not compromised.

The breach affected 11,742 customers in seven countries, exposing names, email addresses, phone numbers and delivery addresses for orders placed between 10 May and 8 August; a further 1,947 had names, home cities and email addresses exposed. Trezor is checking whether earlier orders were also affected, although ShipMonk was required under its 90-day data-retention policy to delete or anonymise such information; Trezor has contacted affected customers and is developing an anonymous locker-delivery option.