Trezor Data Breach Expands, Exposing 67,000 Additional U.S. Customers to Phishing Risks
Hardware wallet provider Trezor revealed that a data breach affecting its customers is far larger than initially reported, now impacting an additional 67,000 U.S. users. The breach stems from a security lapse at shipping provider ShipMonk, which failed to delete order data from customers who purchased Trezor devices between November 2019 and August 2021.
Exposed information includes full names, email addresses, phone numbers, shipping addresses, and order details. While Trezor’s systems were not directly compromised, the leaked data heightens the risk of phishing attacks, where threat actors could impersonate Trezor to trick users into revealing their seed phrases critical for accessing wallet funds.
The incident was first disclosed in August, when Trezor estimated only 14,000 users were affected. In January 2024, the company warned that 66,000 users who had contacted support since December 2021 were also at risk. The latest update, shared via an X post on Friday, confirms the expanded scope of the breach.
Phishing and social engineering attacks remain a dominant threat in the crypto space, accounting for $306 million of the $482 million lost in Q1 2024, per blockchain security firm Hacken. Recent incidents, such as a July case where an investor lost nearly $1 million after signing a malicious Ethereum transaction, underscore the financial risks of such scams.
ShipMonk cybersecurity rating report: https://www.rankiteo.com/company/shipmonk
Trezor cybersecurity rating report: https://www.rankiteo.com/company/trezor
"id": "SHITRE1788524875",
"linkid": "shipmonk, trezor",
"type": "Breach",
"date": "11/2019",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '67,000 additional U.S. users '
'(total affected: 81,000+)',
'industry': 'Cryptocurrency',
'location': 'Global (primarily U.S. customers '
'affected)',
'name': 'Trezor',
'type': 'Hardware wallet provider'},
{'industry': 'Logistics',
'name': 'ShipMonk',
'type': 'Shipping provider'}],
'attack_vector': 'Third-party vendor compromise',
'customer_advisories': 'Warning about heightened phishing risks and advice to '
'avoid sharing seed phrases.',
'data_breach': {'number_of_records_exposed': '67,000 additional records '
'(total: 81,000+)',
'personally_identifiable_information': 'Full names, email '
'addresses, phone '
'numbers, shipping '
'addresses',
'sensitivity_of_data': 'High (potential for phishing attacks '
'targeting seed phrases)',
'type_of_data_compromised': 'Personal identifiable '
'information (PII), order '
'details'},
'date_publicly_disclosed': '2024-08-01',
'description': 'Hardware wallet provider Trezor revealed that a data breach '
'affecting its customers is far larger than initially '
'reported, now impacting an additional 67,000 U.S. users. The '
'breach stems from a security lapse at shipping provider '
'ShipMonk, which failed to delete order data from customers '
'who purchased Trezor devices between November 2019 and August '
'2021. Exposed information includes full names, email '
'addresses, phone numbers, shipping addresses, and order '
'details. While Trezor’s systems were not directly '
'compromised, the leaked data heightens the risk of phishing '
'attacks, where threat actors could impersonate Trezor to '
'trick users into revealing their seed phrases critical for '
'accessing wallet funds.',
'impact': {'brand_reputation_impact': 'Heightened phishing risks and '
'potential loss of customer trust',
'data_compromised': 'Full names, email addresses, phone numbers, '
'shipping addresses, order details',
'identity_theft_risk': 'High (phishing attacks targeting seed '
'phrases)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Third-party vendors pose significant risks; failure to '
'delete customer data can lead to large-scale breaches. '
'Phishing remains a dominant threat in the crypto space.',
'motivation': 'Phishing and financial gain',
'post_incident_analysis': {'root_causes': 'Security lapse at third-party '
'vendor (ShipMonk) failing to '
'delete customer order data.'},
'recommendations': 'Enhance third-party vendor security audits, implement '
'stricter data retention policies, and educate customers '
'on phishing risks and seed phrase security.',
'references': [{'date_accessed': '2024-08-02',
'source': 'Trezor X (Twitter) post'},
{'date_accessed': '2024-08-02',
'source': 'Hacken (blockchain security firm)'}],
'response': {'communication_strategy': 'Disclosure via X (Twitter) post'},
'title': 'Trezor Data Breach Expands, Exposing 67,000 Additional U.S. '
'Customers to Phishing Risks',
'type': 'Data Breach',
'vulnerability_exploited': 'Failure to delete customer order data'}