Trezor–ShipMonk Third-Party Breach: 67,000 U.S. Customers' 'Deleted' Data Exposed — Detection and Response Guide

On Friday, hardware wallet manufacturer Trezor disclosed that a breach at its shipping provider, ShipMonk, has exposed the personal data of an additional 67,000 U.S. customers. The compromised dataset includes customer names, email addresses, phone numbers, shipping addresses, and order numbers spanning November 2019 through August 2021. Trezor has stated the breach does not affect the security of its hardware wallets — and technically, that's correct. But the more damning detail in this disclosure is that this was data Trezor believed had been deleted.

Let me be blunt about what this means from a defender's perspective: a third-party logistics vendor retained customer PII years past its operational usefulness, that retained data was compromised, and the impacted population is now a high-value target list for cryptocurrency-focused phishing and social engineering. Attackers don't need your seed phrase if they can phish it out of you with a convincing, personalized lure referencing your real name, address, and order number. This is the same playbook we saw after the Ledger breach in 2020, which fueled years of targeted phishing, physical mail scams, and even threats of violence against exposed customers.

For SOC teams, IR responders, and CISOs, this incident has two distinct workstreams: (1) defending end users — including your own employees who may be Trezor customers — against imminent, highly personalized phishing campaigns, and (2) auditing your own organization's third-party data-sharing and retention posture, because if it happened to Trezor, your vendors are making the same silent assumptions about deletion.

Technical Analysis

What Was Exposed and Who Is Affected

• Affected population: 67,000 U.S.-based Trezor customers
• Data elements: Full names, email addresses, phone numbers, physical shipping addresses, and order numbers
• Exposure window: Orders placed between November 2019 and August 2021
• Root cause: Breach at ShipMonk, a third-party order fulfillment/shipping provider
• Critical governance failure: Trezor stated the data had been deleted; it had not been. This indicates a failure in vendor data lifecycle management — either deletion was never contractually enforced, never verified, or the vendor retained data in backups, analytics exports, or secondary systems outside the scope of the deletion request.
• Not affected: Hardware wallet firmware, device security, seed phrases, private keys, or on-device assets. There is no CVE here — this is a data governance and third-party risk failure, not a software vulnerability.

The Actual Attack Chain Defenders Should Expect

The breached data itself is not the endgame — it's the ammunition. Based on how similar hardware-wallet customer datasets have been weaponized (Ledger being the canonical case), defenders should expect the following attack progression:

1. Reconnaissance & list enrichment: Attackers combine the breached PII with OSINT and prior breach corpora to build enriched profiles — linking email addresses to employers, LinkedIn profiles, and known crypto holdings.
2. Targeted phishing (spear phishing): Emails impersonating Trezor, ShipMonk, or shipping carriers referencing the victim's real name, real address, and real order number. Common lures: "confirm your shipping address for a replacement device," "your order requires customs verification," "your wallet firmware is out of date — verify your recovery seed."
3. Seed phrase harvesting: Victims are directed to lookalike domains hosting cloned Trezor Suite interfaces or fake "verification" portals that request the 12/24-word recovery phrase. This is the monetization step — full wallet drainage.
4. Vishing and smishing: Phone numbers enable callback scams impersonating Trezor support, and SMS lures with malicious links.
5. Physical targeting: Exposed home addresses have, in prior hardware-wallet breaches, been used for physical extortion threats. This is a real-world safety consideration for high-net-worth victims, not just a cyber risk.

Exploitation Status

There is no software exploit to track — no PoC, no CISA KEV entry, no patch. The "exploitation" is the criminal misuse of the exposed dataset, which historically begins within days to weeks of such a breach becoming public (or being sold). Treat the phishing threat as active and imminent for anyone in the affected population. For organizations, employees who purchased Trezor devices for corporate or personal use during the 2019–2021 window are now elevated-risk phishing targets.

Detection & Response

The defensive value here concentrates in two places: catching the Trezor-themed phishing lures that will inevitably follow, and catching the class of behavior (bulk customer data export) that characterizes the vendor-side breach itself. The detections below are tuned to the specific observable indicators of this campaign type.

SIGMA Rules

---
title: Trezor-Themed Phishing Lure - Shipping or Order Verification Pretext
id: 3f8c1a72-4b6e-4d29-9c51-8a7e2f0b3d44
status: experimental
description: Detects inbound emails leveraging Trezor/ShipMonk breach-themed lures such as shipping verification, order confirmation, or wallet replacement requests. Tuned against lure language consistent with post-breach phishing of hardware wallet customers.
references:
  - https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/09/14
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: email
  product: generic
detection:
  selection_brand:
    Subject|contains:
      - 'trezor'
      - 'shipmonk'
    Body|contains:
      - 'trezor'
      - 'shipmonk'
  selection_lure:
    Subject|contains:
      - 'shipping'
      - 'shipment'
      - 'delivery'
      - 'order'
      - 'replacement'
      - 'verify'
      - 'customs'
      - 'address confirm'
  selection_sender:
    SenderDomain|endswith:
      - 'trezor.io'
      - 'shipmonk.com'
  condition: selection_brand and selection_lure and not selection_sender
falsepositives:
  - Legitimate marketing or transactional mail relayed through third-party ESPs on behalf of Trezor; validate SPF/DKIM alignment and ESP sending infrastructure before escalating
level: high
---
title: Seed Phrase Harvesting Lure - Recovery Phrase Solicitation via Email
id: 91d4e6b0-2c7f-4a38-b5e2-6f1d9c0a8e77
status: experimental
description: Detects emails soliciting cryptocurrency recovery/seed phrases or wallet verification, a monetization pattern seen after hardware wallet customer data breaches (Ledger, Trezor).
references:
  - https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html
  - https://attack.mitre.org/techniques/T1656/
author: Security Arsenal
date: 2026/09/14
tags:
  - attack.initial_access
  - attack.t1656
  - attack.t1566
logsource:
  category: email
  product: generic
detection:
  selection_phrase:
    Body|contains:
      - 'recovery seed'
      - 'seed phrase'
      - 'recovery phrase'
      - '12 words'
      - '24 words'
      - 'verify your wallet'
      - 'validate your wallet'
  selection_wallet:
    Body|contains:
      - 'trezor'
      - 'ledger'
      - 'hardware wallet'
      - 'cold wallet'
  condition: selection_phrase and selection_wallet
falsepositives:
  - Security awareness newsletters or internal training content discussing seed phrase safety; exclude known internal sender domains
level: critical
---
title: Bulk Customer Database Export from Web Application Context
id: b27e59c1-8d03-4f6a-9b14-5c2e7a1d9038
status: experimental
description: Detects database dump utilities (mysqldump, pg_dump, sqlcmd) spawned by web server or application server processes, indicative of bulk customer PII exfiltration from e-commerce or fulfillment platforms such as those operated by shipping providers.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/09/14
tags:
  - attack.collection
  - attack.t1530
  - attack.exfiltration
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/node'
      - '/java'
  selection_child:
    Image|endswith:
      - '/mysqldump'
      - '/pg_dump'
      - '/mongoexport'
      - '/mysqlpump'
  condition: selection_parent and selection_child
falsepositives:
  - Scheduled backup jobs invoked through application orchestration; baseline and exclude known maintenance windows and service accounts
level: high

KQL — Microsoft Sentinel / Defender Hunting

This query hunts for Trezor/ShipMonk-themed phishing emails delivered to your organization, flagging messages where the sender domain does not legitimately belong to Trezor or ShipMonk. Run it across the exposure period through the present and prioritize recipients who are known hardware wallet users (e.g., members of a finance or treasury team).

// Hunt for Trezor/ShipMonk breach-themed phishing lures delivered to the organization
let LureTerms = dynamic(["shipping", "shipment", "delivery", "order", "replacement", "verify", "customs", "seed phrase", "recovery phrase", "validate your wallet", "confirm your address"]);
EmailEvents
| where TimeGenerated > ago(30d)
| where Subject has_any ("trezor", "shipmonk")
   or EmailEvents.BodyPreview has_any ("trezor", "shipmonk")
| extend SenderDomain = tostring(split(SenderFromAddress, "@")[1])
| where SenderDomain !in~ ("trezor.io", "shipmonk.com")
| extend LureMatched = Subject has_any (LureTerms)
| where LureMatched or BodyPreview has_any (LureTerms)
| project TimeGenerated, Subject, SenderFromAddress, SenderDomain, RecipientEmailAddress,
          DeliveryAction, DeliveryLocation, ThreatTypes, AttachmentCount, UrlCount, NetworkMessageId
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url
  ) on NetworkMessageId
| summarize Urls = make_set(Url), FirstSeen = min(TimeGenerated)
    by Subject, SenderFromAddress, SenderDomain, RecipientEmailAddress, DeliveryAction, ThreatTypes
| order by FirstSeen desc

Companion hunt for outbound connections to freshly registered, wallet-themed phishing infrastructure — useful when a user reports they "may have clicked something":

// Identify endpoints reaching likely wallet-phishing domains (recently seen, non-corporate)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("trezor", "ledger", "wallet-verify", "seed-phrase", "wallet-recovery")
| where RemoteUrl !has_any ("trezor.io", "ledger.com")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
          RemoteUrl, RemoteIP, ActionType
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts endpoints for browser-origin downloads and recently created files consistent with phishing-driven follow-on payloads (e.g., fake "Trezor Suite" installers or clipboard-stealing malware dropped after a lure click), a common second stage in wallet-targeting campaigns.

-- Hunt for recently downloaded executables masquerading as wallet software installers
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:/Users/*/Downloads/*')
WHERE FullPath =~ '(?i)(trezor|ledger|wallet|suite)[-_ ]?(setup|install|update)?.*\.(exe|msi|dmg|appimage)$'
   AND Mtime > (now() - 1209600)
ORDER BY Mtime DESC

-- Correlate running processes named to impersonate legitimate wallet software
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(trezor|ledger|wallet)'
   AND Exe !~ '(?i)(C:/Program Files|Trezor|SatoshiLabs)'

Remediation Script

The following PowerShell script performs two defensive actions via Exchange Online: it searches for and soft-deletes Trezor/ShipMonk-themed phishing emails matching the lure patterns, and it reports on delivery so the SOC can scope exposure. Requires the ExchangeOnlineManagement module and Security & Compliance permissions.

# Requires: ExchangeOnlineManagement module, eDiscovery/purge permissions
# Searches for and removes Trezor/ShipMonk-themed phishing lures from mailboxes

Connect-IPPSSession

# Build the query: brand terms AND lure terms, excluding legitimate senders
$query = @'
(subject:"trezor" OR subject:"shipmonk") AND
(subject:"shipping" OR subject:"order" OR subject:"verify" OR subject:"replacement" OR subject:"customs" OR subject:"seed phrase")
AND NOT from:*@trezor.io AND NOT from:*@shipmonk.com
'@

# Create the compliance search scoped to all mailboxes, last 45 days
$search = New-ComplianceSearch -Name "Trezor-ShipMonk-Phish-Purge" `
    -ExchangeLocation All `
    -ContentMatchQuery $query

Start-ComplianceSearch -Identity $search.Name

# Wait for completion, then review BEFORE purging
do {
    Start-Sleep -Seconds 30
    $status = Get-ComplianceSearch -Identity $search.Name
} while ($status.Status -ne "Completed")

# Review results - validate no false positives before taking action
Get-ComplianceSearch -Identity $search.Name | Format-List Name, Items, Size, Status

# Preview the matched items
New-ComplianceSearchAction -SearchName $search.Name -Preview

# After validation, soft-delete the malicious mail (recoverable for 14 days)
New-ComplianceSearchAction -SearchName $search.Name -Purge -PurgeType SoftDelete

# Report affected recipients for targeted user notification
$preview = Get-ComplianceSearchAction -Identity "$($search.Name)_Preview"
$preview.Results

Remediation

For Trezor Customers (and Employees Who Are Customers)

1. Assume targeted phishing is coming. Any email, SMS, call, or physical letter referencing your Trezor order, shipping details, or device — even one that knows your real name, address, and order number — should be treated as hostile until independently verified through official channels navigated to manually (type trezor.io yourself; never click).
2. Your recovery seed is never requested. Ever. No legitimate Trezor process, support interaction, firmware update, or "verification" requires entering your seed phrase into a website, form, email reply, or phone call. Any request for it is theft in progress.
3. Verify firmware and Suite software only through official channels. Download Trezor Suite exclusively from trezor.io and verify signatures. Never install "updated" software delivered via email links.
4. Enable a passphrase (hidden wallet) if you haven't — it adds a layer of protection even if the seed is partially compromised through social engineering.
5. Physical safety awareness: Given exposed home addresses, high-value holders should be discreet about holdings and treat unsolicited physical mail or visitors claiming Trezor affiliation as suspicious.

For Security Teams and CISOs

1. Notify and arm your users. Issue a targeted awareness bulletin about hardware-wallet-themed phishing using the specific lure patterns above. Employees in finance, treasury, or executive roles who hold crypto are priority targets.
2. Deploy the detections in this article. The email-lure Sigma rules and KQL hunts are tuned to this campaign's observable pretext language; run the KQL retroactively across at least the last 30 days.
3. Block lookalike infrastructure proactively. Feed domain-watch services (or your TI platform) with trezor/shipmonk lookalike monitoring; sinkhole or block newly registered domains containing these brand terms at your secure email gateway and DNS layer.
4. Audit your own third-party data exposure. This breach's root failure was unenforced data deletion at a fulfillment vendor. For every vendor that receives customer or employee PII (shipping, marketing, print, event platforms), verify: (a) contractual deletion obligations with defined retention windows, (b) documented deletion attestations, and (c) whether deletion covers backups and analytics copies. If you've never verified a deletion attestation, assume the data still exists — that's the Trezor lesson.
5. Minimize what you share. Shipping providers need a name, address, and tracking contact — not your full customer record. Apply data minimization to vendor integrations now; review what fields your e-commerce platform actually transmits to fulfillment partners.
6. Update your IR playbooks for third-party breaches. Your playbook should cover: vendor notification SLA, evidence preservation rights, customer notification decision trees, and regulatory exposure (state breach notification laws apply to the PII categories exposed here — names plus addresses trigger statutes in most U.S. states).

The Strategic Lesson

Trezor did many things right — the wallet itself remains secure, and the company disclosed. But "we thought it was deleted" is the phrase that should echo in every third-party risk review you conduct this quarter. Data that exists is data that can be breached. Retention schedules and deletion clauses that are never verified are not controls — they're assumptions. In 2026, with supply-chain and third-party breaches continuing to dominate incident volume, vendor data lifecycle verification belongs in the same tier as MFA and patching: non-negotiable.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub