Trezor customer data exposed

[OmegaStarScream]

Looks like the shipping provider Trezor uses (ShipMonk) had a data breach: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

We’re extremely sorry to inform our community that customer personal information, including full names, phone numbers, email addresses, and shipping addresses, has been accessed by an unauthorized actor during this breach.

The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezor’s strict 90-day data storage policy

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

[Upgrade00]

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

Its about time a solution like this was implemented by all hardware wallets which has to ship to users. Besides what users can do to reduce their level of exposure if they have to still submit some sensitive details like addresses, they are always at risk in case of a breach and there are one too many points of failure.

I'm guessing they are starting the anonymous orders with the areas they get the most users. Many in the other parts of the world still has to order from a third party.

[Charles-Tim]

Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

Wrench attack is on the rise in some countries.

I'm guessing they are starting the anonymous orders with the areas they get the most users. Many in the other parts of the world still has to order from a third party.

Trezor is shipping to 196 countries. That is almost all countries in the world.

[Zaguru12]

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

Wrench attack is on the rise in some countries.

This is apparently similar to the ledger data breach, this is now giving access to scammers for their social engineering attacks. Phishing emails, fake phone calls, fake security updates and some fake deliveries, all this can be controlled but this particular wrench attack is the biggest worry of this data breach because there is no way you’re convincing your attacker you don’t own some coins and the fact that they know you just bought a hardware wallet means it’s not for small amount storage.

Does this opens doors for more inclination towards one setting up their own cold wallet by themselves maybe buying because without anonymity purchasing hardware wallet is a big problem

[albon]

Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

Wrench attack is on the rise in some countries.

Since it’s a hardware wallet, you’d expect better privacy and security.. Therefore, the leak of data from more than 13K customers is a serious problem.

I think the anonymous delivery coming in September could help avoid something like this from happening again. This could be a good option instead of relying on Trezor’s shipping partners, especially after what happened with ShipMonk.

They could also make the shipping partners follow a stricter policy, like anonymizing customer and order details just a few days after delivery instead of keeping it that long.

Honestly, it’s not just about phishing emails. This information could also be used for targeted phone calls, texts, blackmail, or threats.

[GreatArkansas]

So, we may expect more incoming victims related to this as they will fall for some phishing or social engineering.

I'm curious how Trezor team will handle this especially affected customers, for example if they will call or send email, how they will convince that they are the real from Trezor 

[Asiska02]

Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

Wrench attack is on the rise in some countries.

A wrench attack is very possible in this case. With the amount of personal information that has been breached, it is enough for a physical coercion with the user which in some countries it is actually on the rise. The good news is that their seed phrase and private keys are safe and no one will have access to their wallet with this information unless they fall for phishing emails, SMS or calls.

With the quick response from Trezor to contact all affected users through a separate email, it shows how concerned they are and taking quick action to minimize any possible retaliation to their customers through the breach. The amount of personal information required from this self custody is much, it should be minimized. Hopefully with this breach, they can fast track their plan to introduce anonymous delivery intended for September 2026.

I'm curious how Trezor team will handle this especially affected customers, for example if they will call or send email, how they will convince that they are the real from Trezor  

All affected customers have been contacted separately by email. If you did not receive an email from help@trezor.io then you are not affected by this data breach.

To be clear, our systems were not compromised, and your Trezor device is secure, but the affected customers might be targeted by more sophisticated phishing attempts.

This fast action taken by Trezor should suffice unless any of the user’s didn’t get to receive a mail about it or miss checking their mail box earlier about it. Any form of call, SMS, or phishing email directing an action to their Trezor wallet should already signify a red flag to them. They should not act in fear to such attempt by scammers, the main thought of concern is the wrench attack of users already breached of their personal information.

[Wind_FURY]

Looks like the shipping provider Trezor uses (ShipMonk) had a data breach: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

We’re extremely sorry to inform our community that customer personal information, including full names, phone numbers, email addresses, and shipping addresses, has been accessed by an unauthorized actor during this breach.

The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezor’s strict 90-day data storage policy

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

Ledger users looking at Trezor users who are about to be hanged, and asking them - "First time"?

Laughable to be honest.

[Comeacross]

A wrench attack is very possible in this case. With the amount of personal information that has been breached, it is enough for a physical coercion with the user which in some countries it is actually on the rise. The good news is that their seed phrase and private keys are safe and no one will have access to their wallet with this information unless they fall for phishing emails, SMS or calls.

No matter how safe your keys are, you're likely to give out when you're attacked. The attackers are usually merciless and you'll have to choose between your life or the keys. I'm not a seer but I can tell what your choice would be in such situation. The best they can do is to review personal details information needed for delivery and make it secretly as possible.

With the quick response from Trezor to contact all affected users through a separate email, it shows how concerned they are and taking quick action to minimize any possible retaliation to their customers through the breach. The amount of personal information required from this self custody is much, it should be minimized. Hopefully with this breach, they can fast track their plan to introduce anonymous delivery intended for September 2026.

I respect their transparency tbh. They can conceal the incident and pretend like nothing happen but they choose to make it public, offer apology and reveal how they are working to minimise the future occurrence.

Regardless, if we keep having incidents like this with hardware wallets, people might begin to lose interest in using them.

[noorman0]

-snip-
Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

The question is whether there is still a pool of potential new customers (new data); existing customers would not benefit from the new method unless the leaked data did not consist of permanent information (though my gut feeling suggests otherwise, most of them).

[BlackHatCoiner]

That should sell pretty good on the dark web.

The most anonymous way to purchase a hardware wallet is to build it yourself, unfortunately. SeedSigner is a signing device that has plenty of material to watch and do it your own, it is not too technical. But in general, I have come to the conclusion that using an airgapped laptop with Linux, and you use it just to sign transactions, probably beats most of the hardware wallets.

[rdluffy]

When I read the first post on my X and the first sentence: “We have some difficult news to share.”

I almost had a heart attack
Thanks, Trezor, for putting my heart to the test

I didn’t want to be a Trezor buyer from that shipment, it’s quite dangerous to have your full data leaked, which could lead to potential crimes
Here in Brazil, on top of that, it’s really complicated because of the lack of security we have, it's easy for criminals to make a scam for you with all this data

[sergiorus]

Brutal month for hardware wallet industry...

Imagine losing everything you held on your Coldcard, then going to reserach the safest hardware wallet options, discovering and ordering Trezor just to have your info leaked a few days afterwards...

That's not funny, of course. My heard, once again, goes to everyone affected. However, that's just another reminder that every time you fill in your address and other data somewhere on the internet, there is always a chance it will be leaked.

[Pmalek]

Hopefully the 13k affected users is the full extent of the data breech and not an early estimate that will be significantly increased after a more thorough analysis. That's already as bad as it gets in terms of privacy loss for the people whose data got leaked. I hope we won't see an update soon where we learn that ShipMonk was in fact storing user data for years without deleting it and the numbers are much bigger.

[Cookdata]

Anytime I see ledger is compared to Trezor, I don't look twice before I rushed to the thread to defend them with data breached but here is Trezor with 11k full personal data.

With users shipping addresses included in the data breach, I'm sure this version of scam that once targeted to Leger users will soon hit the affected users.

[Livingleged]

Imagine losing everything you held on your Coldcard, then going to reserach the safest hardware wallet options, discovering and ordering Trezor just to have your info leaked a few days afterwards...

Immediately I saw the notification about this very trezor data breach, this was exactly what came to my mind. And I’m already even having a rethink about how to handle hardware wallet henceforth, Although this might be easier to contain than that of coldcard I think because the coldcard has to do with the firmware that generates the entropy. What I’m thinking is just how the trezor is going to help handle posbilities of wrench attacks by some other scammers. If I want to be honest,I’ll assume there is an agenda to discourage the adoption of hardware wallets and self custody it self.

[bitbollo]

Perfect timing. It's a continuous attack to self-custody or maybe yes, this provider has been just unlucky and lost this data ?
I am surprised to see also that TREZOR has provided such numbers of their business available to competitors - it could allow to estimate some data about sales / total revenue... it's an useless transparency. This number doesn't help at all...

...
Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

I am interesting to see this solution/uptade since they would have to handle shipping in the EU with new regulation about packaging recycling that involves registration in a single country (each of EEA)...

[suzanne5223]

Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

Wrench attack is on the rise in some countries.

I believe the users whose full names, shipping addresses, phone numbers, email addresses, and order numbers exposed experiencing wrench attacks, and phishing emails are the major issue here.
This serves as another lesson for all of us about not using our real name, address, emails, and always one time or online paid phone number when buying our crypto related items because the exposed private data is already being sold on the dark web as we speak, and there's no guarantee that the accident is not an insider job.

[Ruttoshi]

With all these attacks on hardware wallet that the faults are from the companies, it's scary for me to trust any of these hardware wallet anymore to be super safe.

The best and most secured hardware wallet for my will be Electrum cold storage because you are the one to set up the wallet yourself and generate the private keys yourself with an airgapped device without sharing any of your data with anyone. Who knows which hardware wallet will be next.

[_act_]

The best and most secured hardware wallet for my will be Electrum cold storage because you are the one to set up the wallet yourself and generate the private keys yourself with an airgapped device without sharing any of your data with anyone. Who knows which hardware wallet will be next.

If I can sacrifice a device for airgapped purpose, I think that should also be called a hardware wallet, but best to use airgapped device to differentiate between them.

No one will know that you have a wallet if you use Electrum on a device that is airgapped. It is just the best.

For altcoins Unstoppable can be used offline.