Trezor says ShipMonk kept 67,000 customer records it had certified as deleted

Deletion was the only control that could have helped here. ShipMonk was breached through CVE-2026-72898, a SQL injection flaw in Metabase rated CVSS 10.0 and exploited as a zero-day ^[8]. There was no patch to apply that day and no window to beat. Whatever sat in that Metabase instance was reachable, and Holborn says what sat in it was Trezor customer order detail ^[12]. The size of this breach was therefore fixed before the exploit ran, by which records were still there.

Trezor's two disclosures now total 80,689 customers: 13,689 announced last month, 67,000 on Friday ^[13]. The first group falls inside Trezor's stated retention window, which it says is the shortest period covering delivery, returns and any refund or replacement ^[4][14]. The second does not. The newest orders in the exposed set date to August 2021, so under a 90-day policy the last of them should have been deleted or anonymised around November 2021; ShipMonk reported the intrusion on August 10, 2026, roughly four years and nine months later ^[18]. That makes 83 percent of Trezor's known exposure data that both parties had agreed in writing no longer existed ^[17].

Trezor says it repeatedly requested and received written assurance of deletion, in line with its contract and data policy ^[1]. That is where the record stops. Neither Trezor's statement nor Holborn's account says whether Trezor held audit or sampling rights over ShipMonk's systems, whether any confirmation was ever tested against a live query, or whether the confirmations were false when written or merely scoped to a system that was not the reporting copy. An attestation that names a dataset rather than the stores holding it is satisfied by deleting one of them. There was a prior signal: Trezor said the 1,947 customers whose exposure was limited to names, cities and email addresses may include older orders ^[16].

Holborn, an enterprise blockchain security firm, attributes the intrusion to the ShinyHunters extortion gang and says the same Metabase flaw was used against several of the platform's customers to steal data and extort ^[9][11]. Both points rest on Holborn alone. ShipMonk has said nothing publicly, and the account that it has secured the affected systems and improved its security carries no named attribution ^[15][10].

For the 67,000, the exposure is a name tied to a phone number, a shipping address and a hardware wallet order ^[3]. Trezor warns the data supports scam emails, fraudulent calls and letters, and potentially physical risk, and says it has notified affected customers directly ^[5]. The wallets themselves are unaffected ^[6]. Those addresses were current between 2019 and 2021, and the share still valid is now in an extortion crew's hands.