Trezor Data Breach Exposed Personal Information of 67,000 Additional US Customers

Trezor's personal data breach was larger than initially estimated.

Cointelegraph reported on September 4 that Trezor said on X a new investigation by logistics partner ShipMonk found that the personal information of an additional 67,000 US customers was exposed. Those customers placed orders between November 2019 and August 2021.

The leaked data included names, email addresses, phone numbers, shipping addresses and order details. Trezor said ShipMonk had provided written assurances that the order data would be deleted, but it was never erased. The company said its logistics partner was responsible. Trezor's own systems were not breached.

The exposed information could still be used in phishing attacks, putting customers' digital assets at risk. In such attacks, scammers impersonate Trezor, contact users and steal the seed phrase that controls the wallet.

Trezor previously said in August that information belonging to 14,000 people had been exposed through the same logistics partner. In January 2024, it also disclosed that about 66,000 users who contacted its customer support team after December 2021 were exposed to phishing risk.

Phishing and social-engineering attacks are causing major losses even without code vulnerabilities. Blockchain security firm Hacken said $306 million of the crypto industry's $482 million in total first-quarter losses came from those types of attacks.