Trezor said on Friday that another 67,000 U.S. customers were caught up in the data breach at its shipping provider, ShipMonk, which the hardware wallet maker first disclosed last month.

The newly identified records cover orders placed between November 2019 and August 2021, making some of them close to seven years old. ShipMonk passed the finding on to Trezor two days ago.

The exposed data includes names, email addresses, phone numbers, home addresses and order numbers. Trezor said it had repeatedly asked for and received written confirmation from ShipMonk that those records had been deleted, in line with its contract and data policy, and expressed disappointment to learn they had not been. The episode is a reminder that even companies whose own security is intact can be exposed through third-party vendors — in this case a fulfillment provider that held customer records far longer than its contract allowed.

Two days ago, we received an update from our shipping provider, ShipMonk. We're deeply saddened to share the news that the recent data breach affects more customers than originally thought. Another 67,000 customers from the US who ordered between November 2019 and August 2021…

— Trezor (@Trezor) September 4, 2026

When Trezor disclosed the breach in August, it attributed the limited scope to a 90-day deletion policy that it said it had negotiated into its fulfillment partners' terms. That claim now looks considerably weaker: the number of affected customers has grown from 13,689 to roughly 80,700. Breach disclosures that grow over time are common, as investigations uncover additional compromised systems or retained data, and further updates remain possible.

Wallet owners face multiple threats

Trezor's own systems were not breached, and devices, private keys and wallet backups are untouched. The danger, the company notes, is that the records identify confirmed hardware wallet owners at specific home addresses. Alongside warnings about fake emails, calls and letters, Trezor cautioned affected customers about risks to their physical security, and repeated that a wallet backup should never be shared or typed into a website.

Owners of both Trezor and rival hardware wallet maker Ledger were already receiving forged letters in February, printed with holograms, QR codes and forged executive signatures, demanding they activate a fictitious security check or lose access to their wallets. Ledger itself suffered a major e-commerce data breach in 2020 that exposed nearly a million customers' personal details and was followed by years of phishing and threats against those customers — a precedent that illustrates how long stolen buyer data can keep fueling attacks.

At the time, cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals "we can locate you," and that stolen data stays useful for years because people rarely move or change their phone numbers.

The intrusion traces to a critical SQL injection flaw in the analytics tool Metabase, disclosed on August 6, which allowed unauthenticated attackers to steal credentials for connected databases. Laptop maker Framework and form builder Tally were caught in the same wave of attacks, showing how a single vulnerability in widely used software can cascade across many companies' data. ShipMonk has reportedly received extortion emails attributed to the ShinyHunters group, though that attribution remains unconfirmed.

Trezor said it is working to offer anonymous delivery as quickly as possible — an option using locker pickup, neutral packaging and generic sender details so that buyers need not hand over a home address at all.