Trezor's blog (original 13 August 2026; updated 4 September 2026) says ShipMonk, a shipping provider, suffered unauthorized access.

On 2 September 2026 Trezor was told the breach also held order data from prior cooperation (November 2019–August 2021) that ShipMonk had repeatedly assured in writing had been deleted. That tranche affects about 67,000 further US customers with full exposure of name, email, phone, shipping address and order number; all were emailed from privacy@satoshilabs.com. Hardware wallets are not affected; phishing and physical-security risk rise for exposed addresses.

Earlier August disclosures covered customers who ordered to US/UK/Sweden/Colombia/Brazil/Italy/Portugal between 10 May and 8 August 2026 (about 11,742 in the original summary, with later August clarifications). Trezor did not say how ShipMonk was breached.

According to BleepingComputer (13 August 2026), breach notification emails that ShipMonk sent to affected customers, which BleepingComputer reviewed, said the attackers exploited a vulnerability in Metabase's software, and BleepingComputer has since learned that ShipMonk received extortion emails from the ShinyHunters extortion gang.

Trezor has not confirmed either point. Primary: Trezor blog update. Updated 11 Sep 2026: Trezor separately disclosed on 10 September a phishing wave sent from its account at its newsletter provider, Brevo; that story is now on its own desk card.

Correction (24 Oct 2026): an earlier version said unlinked reporting tied ShipMonk's break-in to a specific Metabase CVE number rated CVSS 10.0 and named ShinyHunters as a claimed extortion actor. The card now credits BleepingComputer, which names Metabase but not a CVE number, and the Brevo phishing story has moved to its own card. (source: https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/)