Trezor discloses data breach affecting nearly 14,000 customers
Trezor customer data exposed after logistics provider ShipMonk suffers data breach.
Hardware wallet manufacturer Trezor has disclosed a data breach impacting nearly 14,000 customers. The breach occurred because their shipping and logistics provider, ShipMonk, was compromised. Attackers gained access to customer order data, including names, shipping addresses, email addresses, and phone numbers. ShipMonk exploited a zero-day vulnerability in the analytics platform Metabase to access the data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Trezor?
Get an email when a new story names Trezor, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTrezor's data breach was not caused by a failure in their own systems, but by a zero-day vulnerability exploited in Metabase, an analytics platform used by their third-party logistics provider, ShipMonk. This highlights the critical risk that vendors and partners introduce into an organization's security posture — your security is only as strong as your weakest third-party link. The exposed data (names, addresses, emails, phone numbers) creates downstream phishing and social engineering risks for affected customers, particularly dangerous given Trezor's cryptocurrency-focused user base. Organizations must treat third-party risk management as a core security discipline, not an afterthought.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.