[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVXMenNsDAQeso38g25ELlYxbXs7FgdPzwBVo2Nu3-NU":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"525b544f-ca05-4a9b-b344-b5bb148d69e9","Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted","trezor-says-shipmonk-breach-exposed-67-000-u-s-customers-data-it-said-was-delete-285490","Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets","Hardware wallet maker Trezor disclosed that a breach at its shipping provider, ShipMonk, exposed data for an additional 67,000 U.S. customers. The exposed information includes names, emails, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021. This incident, attributed to the ShinyHunters gang exploiting a zero-day SQL injection flaw in Metabase (CVE-2026-72898), highlights significant third-party risk and concerns Trezor's assurances about data deletion.","ShipMonk breach exposes 67,000 Trezor customers' data previously thought deleted.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ftrezor-says-shipmonk-breach-exposed.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhIuPjOUFz-c7o9qipnKr4soYR6NxJJxAYgcDqwTPl3LB5XXiag7UpIq8-qFzCbiC1cnlpWfyaRvAt9MVxIlSXeuEN_97devL_mSI25Ee73cO47vDq4dqsM8Nq08d7FogI7sVIPWlnMTD-Una_rRwyTyXqKG6am2DrU_EoIESLicWgDvpxsw6e8yAHmJnGI\u002Fs1600\u002Ftrezor.jpg","2026-09-05T14:17:02+00:00","2026-09-05T16:00:05.967708+00:00",8,[17,20,23,26],{"name":18,"type":19},"Metabase","product",{"name":21,"type":22},"Trezor","vendor",{"name":24,"type":25},"ShinyHunters","threat_actor",{"name":27,"type":28},"ShipMonk breach","campaign","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":55,"context":56},"cve","CVE-2026-72898","SQL injection flaw in Metabase exploited in the breach",[21,18],{"controls":59,"vendors":144},[60,89,115],{"slug":61,"name":62,"problem":63,"products":64},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":90,"name":91,"problem":92,"products":93},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":111,"product_name":112,"url":113,"description":114},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":116,"name":117,"problem":118,"products":119},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":160},"third-party-breach-exposes-67k-trezor-customers-whose-data-was-supposedly-deleted","Third-Party Breach Exposes 67K Trezor Customers Whose Data Was Supposedly Deleted","Trezor's shipping provider, ShipMonk, was compromised via a zero-day SQL injection vulnerability (CVE-2026-72898) in Metabase, exposing personal data for 67,000 customers despite Trezor's prior assurances that the data had been deleted. This incident illustrates a critical failure in third-party data governance: organizations cannot simply trust vendor claims about data deletion without verification and contractual enforcement. The breach exposes customers to phishing, social engineering, and targeted attacks — particularly dangerous given Trezor's cryptocurrency-focused user base. It also underscores that an organization's security posture is only as strong as its weakest third-party vendor, making rigorous supplier oversight non-negotiable.",[150,151,152,153,154,155,156,157,158,159],"CIS Control 15 – Service Provider Management","CIS Control 7 – Continuous Vulnerability Management","NIST SP 800-161 – Supply Chain Risk Management","NIST Privacy Framework PR.P-P4 – Data Retention and Disposal","NIST SP 800-53 SA-9 – External Information System Services","GDPR Article 28 – Processor Obligations","GDPR Article 17 – Right to Erasure","GDPR Article 33 – Notification of a Personal Data Breach","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","OWASP Top 10 A03:2021 – Injection",{}]