Trezor says mailing breach leaked 67K more users than first thought

Crypto hardware wallet Trezor says it’s “terribly sorry” after revealing today that another 67,000 US users were leaked in last month’s mailing partner breach. This brings the total number of affected users to over 80,000.

Trezor initially revealed last month that the personal details of 13,689 of its customers had been leaked after bad actors infiltrated ShipMonk’s systems. 

At the time, Trezor downplayed the scale of the incident by claiming its 90-day data policy, which its partners follow, deleted old user data and helped mitigate the leak. 

However, Trezor now claims that this policy was never enforced, and that the data was never deleted. 

“Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,” Trezor claimed. 

Read more: If you filled in a form from Trezor, you may have to change your wallet

It added, “We’re terribly sorry to everyone affected. We take this matter very seriously and are working to ship anonymous delivery ASAP, so you can protect your personal information when placing an order.”

Leaks such as this one can lead to criminals targeting crypto users thanks to the extra information they have at hand to tailor their attacks. 

Trezor says it did not expect further leaks

Trezor told Protos that it’s too early to decide what it will do in repsonse to ShipMonk’s actions and that it’s working to arrange an additional audit of the mailing partner.

The company claims that on August 10, ShipMonk made it aware of the initial leak that covered orders within the last 90 days. It then informed Trezor on September 2 that the leak actually went back to 2019 and 2021.

“Our understanding is that our cooperation from those years was overlooked when the original scope was established,” Trezor said.

When asked why it took ShipMonk to reveal the further leaks, Trezor claims it had “no reason to expect it” thanks to ShipMonk’s repeated assurances.

Trezor initially reached out to Protos last month to reveal the details of the leak, but it hasn’t done so this time around.

When asked why, it said, “The information is public and it is not behind anything. Our priority was reaching the people actually affected.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.