Trezor reports data from 14K users exposed through shipping provider

The wallet provider warned that thousands of users could potentially be at risk of phishing attempts, while advising that all devices, private keys and backups were safe.

Cryptocurrency wallet company Trezor reported a breach of personal data affecting about 14,000 users through its shipping provider, ShipMonk. 

Trezor’s Wednesday blog post said users who received its products from the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal between May 10 and Aug. 8 were at risk from potential phishing attacks using their personal information. The company reported that 11,742 customers could have had their name, physical address, phone number, and email address compromised, while 1,947 users potentially had their name, city, and email address breached.

“To be clear, our systems were not compromised, and your Trezor device is secure, but the affected customers might be targeted by more sophisticated phishing attempts,” said the company. “Scammers can use the leaked information to send fake emails, make fake phone calls, send fraudulent letters, or potentially impersonate banks, crypto exchanges, or even Trezor.”

The breach was the latest incident involving scammers potentially targeting crypto holders using personal data. Trezor reported in January 2024 that about 66,000 users were at risk of phishing attacks if they had contacted the company’s support team since December 2021. 

Crypto wallet users have revealed that scammers use a variety of techniques in attempts to gain access to their funds, including through physical letters in the mail. Other methods include text messaging, emails and phone calls claiming to be family members in need of help or impersonating authorities asking for repayment of a fake debt.

Related: Do the Coldcard attacks mean all hardware wallets are now insecure?