Trezor Data Breach Expands as 67,000 Additional Customer Records Exposed

The Scope of the Breach

Hardware wallet manufacturer Trezor has confirmed that an additional 67,000 customers have been affected by a data breach originating from its third-party logistics provider, ShipMonk. According to reports from The Block, the compromised records include sensitive personal information such as names, email addresses, phone numbers, physical shipping addresses, and specific order details. This expansion of the breach highlights a significant failure in data retention protocols, as some of the exposed information dates back to 2019.

Failure in Data Retention Policies

While Trezor previously maintained that its partners were required to adhere to a strict 90-day data retention policy, the latest findings indicate that ShipMonk failed to purge these records as agreed. Decrypt noted that the exposed data spans the period from 2019 to 2021, far exceeding the timeframe Trezor claimed its partners were permitted to store customer information. This lapse has raised questions regarding the oversight of third-party vendors in the crypto hardware supply chain and the security of sensitive user data.

Risks of Social Engineering

Security experts warn that the exposure of contact information and order history creates a prime environment for sophisticated phishing attacks. Because the leaked data includes shipping addresses and order numbers, malicious actors can craft highly convincing messages to target Trezor users. These social engineering scams often attempt to trick victims into revealing their recovery seeds or transferring funds to fraudulent addresses. Trezor has advised its user base to remain vigilant against unsolicited communications that claim to be from the company or its partners.

Implications for Pakistani Crypto Holders

For crypto enthusiasts in Pakistan, this incident serves as a critical reminder of the risks associated with hardware wallet supply chains. While the breach primarily impacted US-based customers, Pakistani users who have ordered devices from international vendors should exercise caution. If you have purchased a Trezor in the past, it is advisable to monitor your email and phone for suspicious activity. Always ensure that you never input your recovery phrase into any website or application, regardless of how legitimate the communication may appear. While this breach does not directly involve the Federal Board of Revenue or local exchange regulations, it underscores the importance of maintaining digital hygiene when interacting with global service providers.

Moving Forward

As the investigation into ShipMonk continues, the crypto community is calling for greater transparency regarding how hardware manufacturers manage user data. Protecting the privacy of wallet owners is paramount, especially as phishing attempts become increasingly targeted. Users are encouraged to enable two-factor authentication on all associated accounts and to treat any unexpected requests for personal information with extreme skepticism. The core takeaway for Pakistani users is to remain vigilant against phishing attempts, as your personal contact data may be vulnerable if it was ever shared with international shipping partners.