Trezor customer data exposed

[Wind_FURY]

Looks like the shipping provider Trezor uses (ShipMonk) had a data breach: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

Ultimately, the fault lies with shipping provider, not Trezor. In my view, Trezor did its best to minimize the negative consequences of such a data leak (such as reducing the data retention period to 90 days), although this offers little consolation to those affected.

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

It raises doubts as to how this could actually be implemented in the current landscape. But let’s wait for the announcement; after all, Trezor wouldn’t make such claims unless they had a "workable" idea. I’m genuinely curious to see what they come up with and whether it could serve as a "starting point" for other manufacturers to adopt a similar approach.

But my main question is: how will local regulators react? Just imagine, parcels being sent between anonymous senders and recipients. It’s like Monero for the postal service. If I were a regulator, I’d want to ban the whole idea.

Is it just me or are others thinking that Trezor kind of (may have) slipped up here as well?

Trezor know they handle very sensitive information ^{their customers details}, wouldnt it be
reasonable to think that...

at the very least the shipper would have been instructed to not correlate the origin of the
packages^Trezor with the customer.

or

at the very most Trezor stipulate that all of the destination addresses be deleted from ShipMonk's
database after the items are delivered, or something to that effect.

But who actually deletes customer information from their databases? All of our personal information, during the information age, is actually very valuable. So all of the information they get from us are stored somewhere and updated as soon as possible if needed.

 

You are right of course, we have absolutely zero control over how our data is handled once it goes
online. And its sad/annoying that there is a monetary value in selling that data and it ending up in
the wrong hands.

But I would have expected Trezor to act differently based on their business model they would be
concerned enough about customers data to make sure it was treated according to their statements.

But it wasn't Trezor that got breached? It was a third-party. Plus keeping records of customers is more convenient and cheaper for ANY business than deleting them only to log them again in the database.

   ¯\_(ツ)_/¯

Exchanges hold your private keys, not you. Apps leave them online, exposed. One security breach.
One account freeze. One crash. Your crypto is gone. Because it was never yours.

Couldnt the same statement from their website be applied to our data and ensure that their agent
ShipMonk adhere to some form of data removal? obviously not, it all comes down to margins and
profits and less about customer data safety.

You're saying it yourself.

It just seems like nobody thought ShipMonk retaining customers data was going to be an issue.

It's all going to be an issue including all of the customer information in Trezor's servers itself, or your personal information in your bank, or your private conversations in your inbox in BitcoinTalk, EVERYWHERE.

In this you are right also.

I believe we need a community guide in how to buy items online more privately. Like the use of P.O. Boxes, burner emails, and other strategies to have your real identity disconnected from your order.

[o48o]

So, we may expect more incoming victims related to this as they will fall for some phishing or social engineering.

I'm curious how Trezor team will handle this especially affected customers, for example if they will call or send email, how they will convince that they are the real from Trezor 

Considering that hacked data was names, cities, phone numbers, and email, i don't see this more scary as all other sites, crypto related or not being hacked all the time. When they hack CEXes for example, they might even get scanned passports and actual addresses with wallet data as well, which i didn't see here.

So i think wrench attacks are unlikely, if you only have full names and a city, but no idea if those sticks have cryptos even in them and how much, why would you even want to risk anything and waste time targeting basically random people.

And i could be wrong, but i am pretty sure that people who buy trezor wallets aren't the same people falling for phishing scams seemingly coming from a compromised company.

[Pumpsta]

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

It's about time.... we're in the age of technology and attacks are all over the place but jesus man, these guys were getting their data leaked like almost on schedule already You'd order a HW & already know your name & address are gonna be on a list in 3-4 months max like it's kinda guaranteed..., now let's see how someone's gonna mess this one up too....

[Agbe]

All these compromises are just making people to be afraid of those wallets, people will be using software Wallets now. The number of customers breached were about 13,689 across 7 countries which are US, Sweden UK, Colombia Brazil, Portugal and Italy. Source . I think the best place to secure our coins now is the non custodial wallets. Since the hardware wallets are prone to attack.

[Lucius]

~snip~
It's all going to be an issue including all of the customer information in Trezor's servers itself, or your personal information in your bank, or your private conversations in your inbox in BitcoinTalk, EVERYWHERE.

In fact, these are not private messages, but personal messages that are not only subject to being revealed to third parties (upon official request), but are also accessible to some other forum members through various forum plugins that many use. Yes, there is at least one popular add-on that can read private messages, although the owner claims it doesn't. Anyone who wants privacy must always use encryption.

[Rikafip]

All these compromises are just making people to be afraid of those wallets, people will be using software Wallets now.

Despite the leaks, that's not the good solution to that problem. There are other ways to receive your hardware wallet without sharing your real name/address etc.

I think the best place to secure our coins now is the non custodial wallets. Since the hardware wallets are prone to attack.

Hardware wallets are non custodial. 

[aoluain]

Looks like the shipping provider Trezor uses (ShipMonk) had a data breach: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

Ultimately, the fault lies with shipping provider, not Trezor. In my view, Trezor did its best to minimize the negative consequences of such a data leak (such as reducing the data retention period to 90 days), although this offers little consolation to those affected.

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

It raises doubts as to how this could actually be implemented in the current landscape. But let’s wait for the announcement; after all, Trezor wouldn’t make such claims unless they had a "workable" idea. I’m genuinely curious to see what they come up with and whether it could serve as a "starting point" for other manufacturers to adopt a similar approach.

But my main question is: how will local regulators react? Just imagine, parcels being sent between anonymous senders and recipients. It’s like Monero for the postal service. If I were a regulator, I’d want to ban the whole idea.

Is it just me or are others thinking that Trezor kind of (may have) slipped up here as well?

Trezor know they handle very sensitive information ^{their customers details}, wouldnt it be
reasonable to think that...

at the very least the shipper would have been instructed to not correlate the origin of the
packages^Trezor with the customer.

or

at the very most Trezor stipulate that all of the destination addresses be deleted from ShipMonk's
database after the items are delivered, or something to that effect.

But who actually deletes customer information from their databases? All of our personal information, during the information age, is actually very valuable. So all of the information they get from us are stored somewhere and updated as soon as possible if needed.

 

You are right of course, we have absolutely zero control over how our data is handled once it goes
online. And its sad/annoying that there is a monetary value in selling that data and it ending up in
the wrong hands.

But I would have expected Trezor to act differently based on their business model they would be
concerned enough about customers data to make sure it was treated according to their statements.

But it wasn't Trezor that got breached? It was a third-party. Plus keeping records of customers is more convenient and cheaper for ANY business than deleting them only to log them again in the database.

   ¯\_(ツ)_/¯

I know, what I'm querying is why didnt Trezor require ShipMonk to take more stringent precautions
with Trezors customer data?