Affected Systems

Trezor cryptocurrency hardware wallet customers who placed orders through ShipMonk logistics provider between November 2019 and August 2026. Total of 81,000 customers affected (67,000 U.S. customers from Nov 2019–Aug 2021, plus 14,000 international customers from May–Aug 2026). Exposed data includes full names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor devices and core systems not compromised.

Exploitation Status

Active exploitation confirmed. Attackers exploited a critical SQL injection zero-day vulnerability in Metabase analytics platform in August 2026 to breach ShipMonk systems. ShinyHunters extortion gang has sent extortion emails to ShipMonk. Same Metabase campaign affected multiple companies including Tally and Framework.

Business Impact

Supply chain breach with significant phishing and social engineering risk. Exposed customer data enables targeted phishing campaigns against cryptocurrency wallet holders—a high-value target demographic. ShipMonk failed to delete customer data as contractually required, retaining records for up to 7 years. Trezor's January 2024 breach resulted in phishing attacks attempting to steal wallet recovery seeds. Organizations using ShipMonk or Metabase should verify exposure. No direct operational impact to Trezor services or device security.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Identify if your organization uses ShipMonk for logistics or Metabase analytics platform; verify patch status for Metabase SQL injection vulnerability exploited in August 2026
  • Review third-party data retention policies and audit compliance with contractual deletion requirements, especially for logistics and analytics vendors
  • Alert security awareness teams to increased phishing risk targeting cryptocurrency users; monitor for ShinyHunters-linked extortion attempts
  • If affected by Trezor/ShipMonk breach, warn users to ignore unsolicited requests for wallet credentials, recovery seeds, or personal information via email, phone, or mail
  • Audit Metabase instances for unauthorized administrator access or SQL injection indicators of compromise from August 2026 timeframe

---

# Geopolitical Context

Geopolitical Context

This incident exemplifies the systemic vulnerability of cryptocurrency infrastructure to supply chain compromise, a vector increasingly exploited by financially motivated threat actors. The breach occurred through ShipMonk, a third-party logistics provider, via exploitation of a Metabase SQL injection zero-day vulnerability. The attack is reportedly linked to ShinyHunters, a prolific extortion group known for monetizing stolen data. While the compromise did not affect Trezor's core cryptographic operations or device security, the exposure of customer shipping and contact data creates downstream risks including targeted phishing and physical security threats. The incident underscores the challenge of enforcing data retention and deletion policies across complex vendor ecosystems, particularly in sectors handling high-value digital assets. The cryptocurrency sector's decentralized ethos contrasts with its reliance on centralized logistics and support infrastructure, creating asymmetric attack surfaces that adversaries continue to exploit for financial gain.

State Actor Alignment

No state actor involvement is indicated in available reporting. The breach appears consistent with financially motivated cybercrime, with extortion demands attributed to the ShinyHunters group—a collective historically focused on data theft for resale and extortion rather than espionage or strategic objectives. ShinyHunters has previously targeted diverse commercial entities across multiple jurisdictions, demonstrating opportunistic rather than geopolitically aligned targeting patterns. The exploitation of a Metabase zero-day vulnerability affecting multiple organizations (including Tally and Framework) suggests a campaign prioritizing vulnerable third-party platforms for broad access rather than tailored intelligence collection. While cryptocurrency infrastructure has drawn attention from state-linked actors in contexts involving sanctions evasion or financial surveillance, this incident lacks indicators of state sponsorship or strategic intent beyond financial extortion.

Business Impacty pro region

The breach's geographic scope—affecting customers in the United States (67,000), as well as Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom—highlights the transnational nature of cryptocurrency supply chains and the regulatory fragmentation governing third-party data handling. U.S. customers represent the majority of affected individuals, reflecting both Trezor's market penetration and ShipMonk's operational footprint in North America. European customers in multiple jurisdictions may trigger GDPR enforcement scrutiny, particularly regarding ShipMonk's apparent failure to comply with contractual data deletion requirements—a violation that could result in regulatory penalties and reputational damage. The incident may accelerate regulatory pressure in the EU and U.S. for enhanced third-party risk management standards in the cryptocurrency sector, where hardware wallet providers serve as critical custody infrastructure. Emerging markets such as Brazil and Colombia, where cryptocurrency adoption is growing amid economic volatility, face heightened phishing and fraud risks given less mature consumer protection frameworks. The breach reinforces the need for harmonized cross-border data protection enforcement in sectors where supply chains span multiple regulatory regimes.

Forecast

If ShinyHunters or affiliated actors monetize the stolen data through underground markets, affected customers are likely to experience sustained phishing and social engineering campaigns over the coming months, potentially targeting cryptocurrency holdings through credential theft or recovery seed compromise. If regulatory authorities in the EU pursue enforcement action under GDPR Article 28 (processor obligations) and Article 17 (right to erasure), ShipMonk may face significant financial penalties, which could prompt broader industry reassessment of logistics vendor contracts and audit practices. If additional organizations affected by the Metabase zero-day campaign disclose breaches, the incident may catalyze increased scrutiny of third-party analytics platforms and their security postures, particularly in sectors handling sensitive financial or personal data. If Trezor's disclosure transparency and customer notification practices are perceived as adequate, the company may mitigate long-term reputational damage; however, recurrence of third-party breaches (following a similar 2024 support portal incident) may erode customer confidence in the firm's vendor risk management. If threat actors leverage the exposed shipping addresses for physical targeting or SIM-swapping attacks—common in high-value cryptocurrency theft—the incident's impact may extend beyond digital fraud to kinetic security risks for affected individuals.