Trezor Says Data of 14K Users Was Exposed by Shipping Provider

Hardware wallet vendor Trezor has disclosed that personal data tied to roughly 14,000 customers may have been exposed through a shipping-related incident involving its logistics provider, ShipMonk. While Trezor emphasized that its own systems were not breached and that customer devices remain secure, the company warned that the information could be used to carry out targeted phishing attempts.

In a blog post released this week, Trezor said customers who received products shipped from the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal during a specific window—May 10 through Aug. 8—may have been affected. The company’s review found that 11,742 customers could have had their name, physical address, phone number, and email address compromised, and that an additional 1,947 users may have had their name, city, and email address exposed.

Key takeaways

• Trezor says the incident did not involve compromising its own systems; customer Trezor devices are not at risk.
• About 14,000 customers could face phishing attempts because shipping data may have been leaked.
• The affected shipments span multiple countries and cover deliveries made between May 10 and Aug. 8.
• Trezor warned scammers may impersonate banks, crypto exchanges, or Trezor itself using stolen contact details.
• The disclosure follows a prior Trezor advisory in January 2024 involving potential phishing targeting customers after contacting support.

What Trezor says was exposed—and who is affected

According to Trezor’s announcement, the risk comes from personal information associated with customers’ orders rather than from any compromise of the underlying wallet or its security infrastructure. The company said customers who received Trezor products in the affected shipping region and date range could be targeted with scams designed to look more legitimate by using specific personal details.

Trezor broke the potential exposure into two groups. The larger group of 11,742 customers may have had a fuller set of identifiers—name, home address, phone number, and email—while 1,947 users may have had fewer data points exposed, including their name, city, and email address. Even when the dataset is smaller, attackers can still use it to craft more convincing social engineering messages, especially if the scam references a recent purchase or delivery.

Phishing risk: why shipping data matters to crypto users

Trezor’s core message is that its hardware remains secure, but that affected customers might be targeted by “more sophisticated phishing attempts” because scammers can use leaked details to improve the credibility of their outreach. In practical terms, the company said criminals could send fake emails, make fraudulent phone calls, or send counterfeit letters—potentially even impersonating banks, crypto exchanges, or Trezor.

That warning aligns with how many crypto-related theft attempts operate: attackers rarely need to break wallet security directly if they can trick users into revealing sensitive information, approving fraudulent transactions, or moving funds under false pretenses. Personalized contact information—like a real address, phone number, or email—can help scammers bypass basic suspicion and increase the odds that a victim engages with the scam.

For investors and active traders, the most immediate concern is not whether the wallet device is compromised, but whether the user’s operational security is. A well-timed phishing campaign can target anyone who has recently installed wallet software, registered an account, or is actively managing assets—exactly the moment when a misleading message could be most convincing.

A pattern of data-driven targeting for crypto holders

Trezor described the shipping-provider incident as part of a broader set of scams that appear to leverage personal data to reach crypto holders. Earlier reporting around Trezor’s own disclosures shows the company has already warned customers about phishing risk tied to customer support interactions.

In January 2024, Trezor reported that about 66,000 users were at risk of phishing attacks if they contacted the company’s support team after December 2021. Earlier coverage from Cointelegraph noted that those users could potentially be targeted because their engagement with support could make them easier to identify for scammers. The new disclosure suggests that, even when devices remain secure, the wider ecosystem—order handling, shipping logistics, and customer contact channels—can become a pathway for criminals to collect enough data to stage convincing impersonation attempts.

Cointelegraph has previously reported that scammers have used additional tactics beyond digital messages, including physical letters sent through mail to manipulate wallet users. Other approaches include text messages and emails or calls where attackers claim to be family members in urgent need, or impersonate authorities to demand repayment for a fake debt. The common thread across these tactics is social engineering—an area where leaked personal data can materially raise the quality and believability of the scam.

What to watch next for affected customers

Trezor’s disclosure does not indicate that the incident enabled direct theft from wallets, and the company states its internal systems were not compromised. However, the company’s framing makes the next steps less about checking the device and more about monitoring for suspicious communications that reference the customer’s recent Trezor shipment or personal details.

Customers in the delivery window and listed countries should be alert for unexpected emails, phone calls, or letters that ask for sensitive wallet-related actions or encourage them to verify account details through links or instructions provided by the caller. With crypto scams frequently evolving in response to user awareness, the practical question now is whether the leaked shipping data begins circulating in the wild and whether follow-on attempts appear in the weeks after this disclosure.

For the broader market, the incident is another reminder that hardware wallet security is only one part of the threat landscape: criminals increasingly rely on data from the customer journey—shipping, support interactions, and contact databases—to make phishing harder to spot. Readers should watch for emerging scam reports tied to delivery-confirmation themes and remain cautious about any outreach that attempts to force immediate actions.