The cryptocurrency hardware security sector is facing turbulence following the announcement of a significant data breach expansion at logistics provider ShipMonk, a partner of Trezor. While initial reports in August estimated that approximately 14,000 individuals were affected, an additional 67,000 U.S. customers have now had their personal information compromised. These records, spanning transactions made between November 2019 and August 2021, include names, postal addresses, phone numbers, and email addresses. The firm has sought to reassure users by confirming that its internal infrastructure remains secure and that the integrity of its physical wallets is unaffected.
The concerning aspect of this incident lies in the service provider's breach of contract. Trezor asserts that it had received written guarantees that this data had been deleted in accordance with its internal policy, which mandates automatic erasure or anonymization 90 days after delivery. The persistence of these files years later raises serious questions regarding data retention practices among third-party partners. This non-compliance exposes the company to heightened liability, while the scope of the breach—already revised upward—leaves lingering doubts regarding the full extent of the information potentially still at risk.
Beyond the typical threat of phishing, this breach introduces a critical dimension involving the physical security of digital asset holders. Possessing a database that links identities, home addresses, and ownership of crypto storage hardware makes these individuals prime targets for malicious actors specializing in extortion or home invasions. At a time when authorities are noting an increase in crypto-related crime, the leak of geographical coordinates is no longer just a cybersecurity issue, but a direct matter of personal safety.
This episode echoes the major breach suffered by Ledger in 2020, illustrating a structural vulnerability inherent to the industry: the reliance on third-party logistics. Unlike ephemeral digital leaks, physical addresses retain constant value on the black market for years. For users, caution is essential: no authority or technical support team will ever ask for a 24-word recovery phrase via mail or phone. Faced with increasingly sophisticated fraudulent solicitation campaigns, vigilance must now extend to all communication channels, including traditional postal mail.