The fallout from hardware wallet provider Trezor's data breach has proven larger than initially estimated, now extending to an additional 67,000 US customers.

In a Friday X post, Trezor said the breach may endanger more US users who placed orders between November 2019 and August 2021, citing the latest update from its shipping provider, ShipMonk.

The affected customers had their full details exposed, including names, email addresses, phone numbers, shipping addresses, and order specifics. Trezor blamed the shipping provider for failing to delete the data from these orders, despite having received written assurances from ShipMonk.

Although Trezor's own systems were not compromised, the breach may threaten the digital asset holdings of the 67,000 customers. Attackers could use the exposed information to launch phishing attacks impersonating Trezor in an attempt to steal users' seed phrases, which control their wallets. Hardware wallets like Trezor's are designed to keep private keys offline precisely to protect against remote compromise, but that protection does not extend to a user who voluntarily hands over their recovery phrase to someone posing as the manufacturer — which is why data leaks of this kind are particularly valuable to social engineering scammers, who can craft convincing, personalized messages referencing real order details.

In August, Trezor initially estimated that only 14,000 users had their data exposed through the shipping provider. Separately, Trezor reported in January 2024 that about 66,000 users were at risk of phishing attacks if they had contacted the company's support team since December 2021. The episode is not unique to Trezor: third-party vendors such as shipping providers, marketing platforms and customer-support tools have repeatedly become the weak link in crypto firms' data security, since companies can control their own infrastructure but depend on contractual assurances from outside partners.

Phishing attacks and social engineering do not require exploiting code vulnerabilities. Even so, these impersonation-based scams drove the majority of the crypto industry's losses in the first quarter of the year, accounting for $306 million of the total $482 million lost, according to blockchain security company Hacken.

In July, a crypto investor lost nearly $1 million after signing a malicious phishing token approval transaction on Ethereum.

Related: Thai businessmen sue Tether for freezing $42M in $61M pig butchering case