Trezor's data breach has widened significantly after its shipping partner, ShipMonk, discovered that thousands of older customer records had remained on its systems. The hardware wallet maker announced Friday that an additional 67,000 U.S. customers were affected, bringing the known total to approximately 80,689.

The newly exposed records relate to orders placed between November 2019 and August 2021. They include names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor said ShipMonk notified it of the additional records on Sept. 2. The fact that the exposed customers bought hardware wallets is itself sensitive, since it tells attackers exactly who is likely to hold cryptocurrency and which device they use — information that has historically made hardware wallet buyers a recurring target of phishing campaigns.

Older Records Raise Data Retention Questions

The disclosure raises questions about how ShipMonk handled customer data. According to Trezor, it repeatedly requested the deletion of the older records and received written assurances that the information had been removed. The company now says, however, that those records remained in ShipMonk's systems.

The discovery also calls into question the effectiveness of Trezor's 90-day data retention policy, which was initially cited as a key reason the August breach affected a smaller number of customers. The gap between written deletion assurances and actual data removal highlights a broader challenge for companies that rely on third-party vendors: data minimization commitments are difficult to verify once information leaves a company's own systems.

The original disclosure involved 13,689 customers. Of those, 11,742 had names, email addresses, phone numbers, and shipping addresses exposed. Another 1,947 customers had more limited information exposed.

Wallets Remain Secure

Trezor stated that its own systems were not compromised. The breach also did not expose private keys or wallet backups, meaning attackers did not gain direct access to customers' cryptocurrency through the incident.

Nevertheless, the leaked information could pose significant risks for affected customers. Attackers may use names, addresses, order details, and contact information to craft convincing phishing messages or impersonate Trezor and financial services.

Trezor has urged affected users to remain cautious about unexpected emails, phone calls, and letters. Customers should never provide wallet backups or enter recovery phrases into websites, regardless of who appears to be requesting them.

The company said all newly identified customers have been contacted directly by email. The expanding breach illustrates how third-party logistics providers can create security risks even when a cryptocurrency company's core systems and wallets remain protected.