Trezor Data Breach Exposes 67,000 Customer Records via Zero-Day Vulnerability

On September 4, 2026, Trezor reported a data breach at its logistics provider, ShipMonk, affecting approximately 67,000 U.S. customers. The breach, which exposed sensitive order data from November 2019 to August 2021, was facilitated by a zero-day SQL injection vulnerability (CVE-2026-72898) in the Metabase analytics platform. The compromised data includes names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor's systems were not compromised, and no wallet keys or funds were exposed. However, the exposed information increases the risk of phishing and social engineering attacks. Trezor had previously disclosed a smaller breach affecting 13,689 customers in August 2026. The attack has been attributed to the ShinyHunters extortion group, known for targeting SaaS and e-commerce providers. Trezor has notified all affected individuals and is advising them to remain vigilant against potential scams.

Key Points: • 67,000 U.S. customer records exposed due to ShipMonk breach. • Breach exploited a zero-day SQL injection vulnerability (CVE-2026-72898). • Attack attributed to the ShinyHunters extortion group.