Order data ShipMonk promised to delete pushes Trezor's breach count to 80,700

Trezor's 80,700 against the 13,689 it reported in August is 5.9 times the original count ^[1][4][14], and the records responsible were US orders placed between November 2019 and August 2021 ^[3]. Under the 90-day deletion policy Trezor credited in August with keeping the number small ^[5], even the newest of those orders was due for destruction around November 2021, about four years and ten months before Friday's disclosure ^[7][16].

The enforcement mechanism, on Trezor's account, was correspondence: it asked ShipMonk more than once for documentation that order data older than 90 days had been deleted, was told each time that it had been, and now says those documents were incorrect ^[6]. Trezor's own stack held, with no devices, private keys or wallet backups involved and no compromise of its systems ^[8]. What the record contains is one side of a two-party contract dispute, with no ShipMonk account of the retention and no funds loss traced to the exposure ^[18].

What a leaked shipping manifest is worth depends on how much verification it saves the buyer. Hacken put phishing and social engineering at $306 million of the $482 million stolen in the first quarter, or 63.5 percent ^[9][15], and February's wave of forged letters to Trezor and Ledger owners, printed with holograms, QR codes and fake executive signatures ^[12], is the channel this particular data feeds. David Sehyeon Baek's observation is the operative one: a forged letter carrying a real name and address changes the psychology of the scam ^[13]. One investor nearly lost $1 million in July by approving a malicious token transaction on Ethereum ^[19], which is roughly the per-head figure an attacker underwrites against.

The counter-thesis, and it is not a weak one, is that names and addresses are commodity data traded and leaked continuously, so the marginal harm is thinner than 80,700 sounds; the scarce field in this file is the confirmation that the addressee bought a hardware wallet. It thickens in one direction. Trezor's January 2024 disclosure covered about 66,000 customers who had contacted support since December 2021 ^[10], so the two published sets total roughly 146,700 records with an overlap nobody has quantified ^[17].

The practical alternatives here are both dull: contractual audit rights that require deletion evidence rather than an affirmative reply, or narrowing what the fulfillment partner ever receives, which is awkward when a physical device has to reach a doorstep. The reading that this is a retention failure rather than a wallet failure breaks in two places worth watching. If ShipMonk documents that the surviving records sat in a backup outside the scope of the deletion term, the story becomes a drafting problem instead of a broken promise; and if a third revision follows the first two, the finding is that Trezor could not size its own customer exposure without its vendor's cooperation ^[11].