Sensitive data breach at a Trezor provider - 11,742 customers affected

[flatfly]

Vendor advisory: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

Vendor tweet: https://x.com/Trezor/status/2087885428313543059

We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days prior to August 8th, 2026.

The data exposed:

- Full names
- Shipping addresses
- Phone numbers
- Email addresses

The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezor’s strict 90-day data storage policy (we were also able to negotiate the same terms with fulfillment partners, who follow the same policy).

All affected customers have been contacted separately by email.

Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts.

NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels.

[vapourminer]

Vendor advisory: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

just perfect. as many of us were recently extolling the virtues of trezors after coldcard

[SquirrelJulietGarden]

Ledger, then Trezor but there are other companies with user data breaches and this newest data breach from Trezor vendor is another risk warning for many people. Their personal information can be leaked anytime by any company and related emails will be likely attacked by scammers and hackers too. It raises a need of using different emails for different purposes if possible. If one email was used for registration on one platform that has data breach, let's consider firstly to change its password, reset 2FA but even have to take a more serious action, moving to a new email.

Trezor will soon appear there
https://haveibeenpwned.com/PwnedWebsites

[Charles-Tim]

Already existing topic: https://bitcointalk.org/index.php?topic=5591152.msg67039978#msg67039978

Please lock this thread, to avoid repetitive posts.

[Zaguru12]

just perfect. as many of us were recently extolling the virtues of trezors after coldcard

While this is not funny at all just imagine someone moving their coins from coldcard after the saga to Trezor and then today they just hear that their data has just been stolen and a potential wrench attack incoming for them.

It will be hard convincing this person to go for another hardware wallet

[Zoomic]

just perfect. as many of us were recently extolling the virtues of trezors after coldcard

While this is not funny at all just imagine someone moving their coins from coldcard after the saga to Trezor and then today they just hear that their data has just been stolen and a potential wrench attack incoming for them.

It will be hard convincing this person to go for another hardware wallet

I had to read down the thread to see someone with same thoughts like mine 

I honestly do not think that there's anyone convincing such person that there hasn't been some kinda compromise in hardware wallet storage.

Imagine after surviving the Coldcard situation, then move your assets to Trevor in search of safety and peace of mind only to have your personal details exposed again, there's no way you wouldn't be questioning your choices. There'll definitely be the feeling that keeping your coins in cold storage isn't a safe practice again 

[flatfly]

Already existing topic: https://bitcointalk.org/index.php?topic=5591152.msg67039978#msg67039978

Please lock this thread, to avoid repetitive posts.

Ah, I wasn't aware of that one (I don't visit that subforum on a regular basis)
Maybe it would make sense to move the earlier topic over here for more visibility?

@Mod, please archive or lock down this thread if needed, thanks.    

[Charles-Tim]

Ah, I wasn't aware of that one (I don't visit that subforum on a regular basis)
Maybe it would make sense to move the earlier topic over here for more visibility?

No, that is the right place the thread should be. This is about a hardware wallet Trezor and the right board to post such thread is under hardware wallet and not bitcoin discussion.

A good forum member should visit all necessary boards or set it on notification.

@Mod, please archive or lock down this thread if needed, thanks.   

The best is to lock the thread yourself. You can scroll down and see lock topic beside move topic at the lower left side.

[Cookdata]

@Mod, please archive or lock down this thread if needed, thanks.    

I'm not sure there is a mod with such username that will prompt a notification of attention, but you can do this as OP. Look down to the end of this thread, you will see it right there.

[AVE5]

Vendor advisory: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

just perfect. as many of us were recently extolling the virtues of trezors after coldcard

All of the unpleasant events in both hardware wallets are quite unfortunate which doesn't imply comprises of their reliance on securities. The lesson behind it should make it obviously understandable that no system is 100 trustworthy.
Let's keep it straight, the Privacy compromise on the coldcard was due to certain model of the brand having loopholes on the seed phrase generation.
That of Trezor was from the shipping provider which loophole was from the third party who's the transportation service company haven loose guarded recipients provided person information including residential addresses.
However, despites the experiences both Coldcard and the Trezor hardware wallets haven't still lost their stands on keeping user's security from their domains.
Certain breach is feasible to happen to any wallet brand too.

[promise444c5]

There’s really no problem if he’s not aware there’s already an existing topic actually as it can easily be locked … Hardware wallet isn’t a Board  most members visit quite often and it’s also a sub board under TD where mostly people interested in technical discussions visit regularly .  

I really don’t blame OP to be honest .
 
I think we can have double threads aswell because this one will reach more people than the hardware wallets board itself.

It’s left to OP to leave it locked or open.. if mod finds it necessary to lock, I believe they can lock it.