Trezor data leak affect more customers

[_act_]

Because Trezor received "written assurance" that confirms deletion of data, and that it's in their contract suggests that ShipMonk should be investigated.

But will the investigation be successful? Since I have been reading about crypto news, I have not read about such investigation before, but if there is, can it be known?

It may not even be the fault of ShipMonk, but the fault from their worker's intention or maybe a mistake. But one thing that I know is that the data breach might be linked to money paid which means the hackers bought it.

If you remember, I posted a [urlhttps://bitcointalk.org/index.php?topic=5586990.msg66884657#msg66884657]topic[/url] few months ago about something like this, that how has Bitcointalk been about to protect their customers email for almost 2 decades, but Trezor, Ledger and other companies are getting it wrong.

I think probably customers data are sold and this will not be the last one.

If the customers are paid for damages, this would have been reduced or not existing anymore, but the governments do not have good law about their people's privacy and which is very bad.

[Z-tight]

Would it be logical to make a presumption that ShipMonk sells customer data that they receive to third-parties?

I wouldn't be surprised if there are more people who also think that could be case. However, i don't think a large and fast-growing company would engage in such a large-scale disingenuous activity. If there were accusations that a rogue member of ShipMonk's staff is suspected of selling customer data, then that is believable, but i don't think the company itself would engage in that, because they stand to lose far more than what they can possibly gain.

[Wind_FURY]

Would it be logical to make a presumption that ShipMonk sells customer data that they receive to third-parties?

  🤔

Because Trezor received "written assurance" that confirms deletion of data, and that it's in their contract suggests that ShipMonk should be investigated.

The question arises as to why they would otherwise keep data that they claim to have been deleted even in writing?

We can assume that they are just careless and that someone in that company is not doing their job - or that they had other plans with that data that they may have used in the meantime. It's a bit strange to me that someone was obviously looking for that data, even though it was officially claimed for years that it had been deleted - which could mean that there was information from the inside that the data still exists.

I will say that all those who in the 21st century continue to keep databases unencrypted should be banned for life from performing any work related to data processing and storage.

OR perhaps ShipMonk's company heads probably thought that all that data were already deleted? BUT there's a bad actor in the company who secretly sells them in the Dark Markets and accepts payment in -  Bitcoin.

It's laughable, and very alarming, if that's true, because how many more bad actors in other companies steal all of that data to sell in the Dark Markets.

[Lucius]

~snip~
OR perhaps ShipMonk's company heads probably thought that all that data were already deleted? BUT there's a bad actor in the company who secretly sells them in the Dark Markets and accepts payment in -  Bitcoin.

It's laughable, and very alarming, if that's true, because how many more bad actors in other companies steal all of that data to sell in the Dark Markets.

Probably a lot, because data is worth a fortune today, and data about potential users of cryptocurrencies is highly valued by hackers because it is wanted by criminals all over the world. In France, this turned out to be a big problem, because a person who had access to the data of people who owned cryptocurrencies sold them to criminals who used them for physical attacks on those same people.

Today, it's best to try to be 100% anonymous when it comes to cryptocurrencies, and even when it comes to paying taxes on them - because I would rather use all available NO-KYC methods if I need to make an exchange coin -> fiat, than pay taxes and wonder where that data will end up.

[Wind_FURY]

~snip~
OR perhaps ShipMonk's company heads probably thought that all that data were already deleted? BUT there's a bad actor in the company who secretly sells them in the Dark Markets and accepts payment in -  Bitcoin.

It's laughable, and very alarming, if that's true, because how many more bad actors in other companies steal all of that data to sell in the Dark Markets.

Probably a lot, because data is worth a fortune today, and data about potential users of cryptocurrencies is highly valued by hackers because it is wanted by criminals all over the world. In France, this turned out to be a big problem, because a person who had access to the data of people who owned cryptocurrencies sold them to criminals who used them for physical attacks on those same people.

Today, it's best to try to be 100% anonymous when it comes to cryptocurrencies, and even when it comes to paying taxes on them - because I would rather use all available NO-KYC methods if I need to make an exchange coin -> fiat, than pay taxes and wonder where that data will end up.

We should probably start finding some "strategies" to hide our identity when ordering hardware wallets and other crypto-related things. Perhaps register for a P.O. Box, then ask your postal service if it's allowed to add a "company name" or a pseudonym as a receiver?

I will look for a guide and post the link in the topic.

[Lucius]

~snip~
We should probably start finding some "strategies" to hide our identity when ordering hardware wallets and other crypto-related things. Perhaps register for a P.O. Box, then ask your postal service if it's allowed to add a "company name" or a pseudonym as a receiver?

I will look for a guide and post the link in the topic.

PO Box is a good strategy because it hides your real identity from whoever is sending you something, I don't think there's any need to ask for anything extra from the postal service. What you cannot avoid is that the service through which you use PO Box knows that you have received something related to cryptocurrencies, because if you order directly from the manufacturer, the sender's address is clearly stated on the package.

The only thing that somehow avoids such a situation is ordering from authorized resellers who sell other things in addition to hardware wallets.

[Wind_FURY]

~snip~
We should probably start finding some "strategies" to hide our identity when ordering hardware wallets and other crypto-related things. Perhaps register for a P.O. Box, then ask your postal service if it's allowed to add a "company name" or a pseudonym as a receiver?

I will look for a guide and post the link in the topic.

PO Box is a good strategy because it hides your real identity from whoever is sending you something, I don't think there's any need to ask for anything extra from the postal service. What you cannot avoid is that the service through which you use PO Box knows that you have received something related to cryptocurrencies, because if you order directly from the manufacturer, the sender's address is clearly stated on the package.

The only thing that somehow avoids such a situation is ordering from authorized resellers who sell other things in addition to hardware wallets.

If there's no other way to have your real identity disconnected from anything crypto-related, then doing it how users did during the early days of Bitcoin is the only solution. Simply buy a computer as an offline device for generating your seed phrase/keys, and NEVER let that computer connect to the internet.

I bought two hardware wallets last year and this year, plus a Bitcoin friend sent me a SafePal through mail. I believe my name and address is out there, and there are people waiting for the right opportunity to move.
   

[Karl_3000]

The only thing that somehow avoids such a situation is ordering from authorized resellers who sell other things in addition to hardware wallets.

In my country, this is also not safe at all and I think it is the risky just like others. If it is home delivery or you will go and pick it at the pickup station, people at the pickup station or that want to deliver it for you at home will know that it is a hardware wallet. When wench attack is becoming common, anyone can be the victim. I prefer what Wind_FURY said which is for people to go back to the old ways which is having the wallet on a device that no one will suspect.

[Lucius]

I bought two hardware wallets last year and this year, plus a Bitcoin friend sent me a SafePal through mail. I believe my name and address is out there, and there are people waiting for the right opportunity to move.

If you think you're in any kind of danger, you need to prepare yourself - surveillance cameras, burglar-proof doors, alarms and of course something for self-defense. Although in reality physical attacks in the majority of cases happen to people whom the attackers have knowledge of possessing a higher value of cryptocurrencies - of course it still depends on the country in which someone lives. $1000 in Europe is not the kind of money that someone will break into your house and attack you for - but elsewhere in the world that might not be the case.

I prefer what Wind_FURY said which is for people to go back to the old ways which is having the wallet on a device that no one will suspect.
~snip~

I agree, it is something that provides the greatest security and anonymity - with, of course, some anonymous way of investing in cryptocurrencies. People who invest by buying through CEXs with full KYC can hardly help themselves even if they take the steps we are talking about.

[satscraper]

We should probably start finding some "strategies" to hide our identity when ordering hardware wallets and other crypto-related things.

The best strategy is to assemble the signing device yourself. The most broadly known DIY projects are based on generic, off-the-shelf components, so in my view, if you buy them separately/scattered, it won't strike anyone as suspicious.

 I would recommend SeedSigner, which could cost around $50–$60 for Pi Zero, camera module for QR scanning, small LCD, and joystick/buttons for navigation, but you might also want to consider Krux or even Blockstream Jade.

[Pmalek]

I see Best Buy is one of Trezor authorized reseller[1]. But do you know that Trezor actually sold on their physical store, rather than only their online store? I don't find such information either from Trezor or Best Buy website.

You probably wouldn't be able to get a Trezor in every Best Buy physical store. My guess is that they are only available in some across the United States. If I was interested in buying a Trezor from my local Best Buy, I would speak with the staff and see if they have them in stock. If they do great. If not, have them check the nearest Best Buy where there are Trezors to buy. Perhaps they can have one delivered from there, store-to-store. Some shops do that. Ordering one online and entering your data in Best Buy's database isn't any better than adding it to Trezor's or some other brands'.

It's a bit strange to me that someone was obviously looking for that data, even though it was officially claimed for years that it had been deleted - which could mean that there was information from the inside that the data still exists.

How do you know that someone was specifically looking for Trezor data and hacked ShipMonk because of it? ShipMonk surely has many other partners besides Trezor. Such a database is valuable, the bigger it is. With Trezor data in it, it's even more valuable.

[Faisal2202]

I happened to find this thread and read the replies. Seems like the dots are not connecting, but what I found after reading this case again and one that I read before a few weeks or days ago might connect some dots that maybe no one in the team knew about due to their skill issue, maybe they did it on purpose, or maybe they know data is expensive and could be sold to anyone.

Anyway, the first dot is, ShipMonk was using Metabase for analytical purposes. The hackers found a vulnerability in that system, so what the reports are saying, with an assumption, is that the cached data, the Metabase logs they say, was never deleted which ShipMonk might be deleting from the surface. Not clearing it down to the basics. I doubt they did it unknowingly, because it is not something they have said so far, so they accept their mistake, but we should wait.

Another dot that came to my mind is that the same Metabase was used by Bits of Gold, and they also lost 20k Israelis' data in this breach. Many companies were using it, and they all lost users' data.

The breach in metabase occured at august 6th and Shipmonk happened to realize this on August 10th? Maybe they needed time for investigation.

PS: Someone said to me once that, no matter how hard you try to stay anonymous, sometimes you are doing something so confidently that it gives you up.

[Coin-Keeper]

I have always used alias temp emails and a "straw purchase" address for delivery.  For me its SOP.  Its not that tough to keep your little wallet accounts from coming back to you with atomic swaps.  You just have to make sure the BTC address you pay with is not related to You.  Again, we all know how to do that.

[ABCbits]

I see Best Buy is one of Trezor authorized reseller[1]. But do you know that Trezor actually sold on their physical store, rather than only their online store? I don't find such information either from Trezor or Best Buy website.

You probably wouldn't be able to get a Trezor in every Best Buy physical store. My guess is that they are only available in some across the United States. If I was interested in buying a Trezor from my local Best Buy, I would speak with the staff and see if they have them in stock. If they do great. If not, have them check the nearest Best Buy where there are Trezors to buy. Perhaps they can have one delivered from there, store-to-store. Some shops do that.

It's about what i expect. Although hearing someone with actual experience (whether success or failure) would be handy for other reader who live near Best Buy physical store.

Ordering one online and entering your data in Best Buy's database isn't any better than adding it to Trezor's or some other brands'.

It could be worse since i doubt Best Buy (along with 3rd party they use) have better privacy policy or data retention compared with Trezor.

[Wind_FURY]

I bought two hardware wallets last year and this year, plus a Bitcoin friend sent me a SafePal through mail. I believe my name and address is out there, and there are people waiting for the right opportunity to move.

If you think you're in any kind of danger, you need to prepare yourself - surveillance cameras, burglar-proof doors, alarms and of course something for self-defense. Although in reality physical attacks in the majority of cases happen to people whom the attackers have knowledge of possessing a higher value of cryptocurrencies - of course it still depends on the country in which someone lives. $1000 in Europe is not the kind of money that someone will break into your house and attack you for - but elsewhere in the world that might not be the case.

I'm not in any real or actual danger, but because we know that our names, physical addresses, and other information are out there, then it would be stupid to make presumptions that we are not targets. Although current "threat-level", I believe, is low for me personally.

Plus I live in a safe/secure area.

[Faisal2202]

PO Box is a good strategy because it hides your real identity from whoever is sending you something, I don't think there's any need to ask for anything extra from the postal service. What you cannot avoid is that the service through which you use PO Box knows that you have received something related to cryptocurrencies, because if you order directly from the manufacturer, the sender's address is clearly stated on the package.

The only thing that somehow avoids such a situation is ordering from authorized resellers who sell other things in addition to hardware wallets.

Maybe new buyers should wait for the availability of their 4th option.

3.Use a P.O. Box if possible to limit address exposure (although an ID will still likely be needed for collection, and your data will be stored by USPS).
4. Anonymous Delivery (coming soon) lets you receive your hardware wallet more privately by using a dedicated checkout, locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers after delivery.

Source

[Karl_3000]

Maybe new buyers should wait for the availability of their 4th option.

3.Use a P.O. Box if possible to limit address exposure (although an ID will still likely be needed for collection, and your data will be stored by USPS).
4. Anonymous Delivery (coming soon) lets you receive your hardware wallet more privately by using a dedicated checkout, locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers after delivery.

Source

PX-Z and myself discussed about the anonymous shipping on this thread if you go to the first page. What I noticed about it is that people are saying how is it going to be possible. Most people that are hearing about it are saying it is not possible, but I think we should wait for it and see how it will look like.

[Wind_FURY]

Maybe new buyers should wait for the availability of their 4th option.

3.Use a P.O. Box if possible to limit address exposure (although an ID will still likely be needed for collection, and your data will be stored by USPS).

4. Anonymous Delivery (coming soon) lets you receive your hardware wallet more privately by using a dedicated checkout, locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers after delivery.

Source

PX-Z and myself discussed about the anonymous shipping on this thread if you go to the first page. What I noticed about it is that people are saying how is it going to be possible. Most people that are hearing about it are saying it is not possible, but I think we should wait for it and see how it will look like.

You will need to give your identity somewhere in the chain of your strategy, and it will be with the application of the P.O. Box with the postal service. That's actually OK because you also know who they are and where their offices are if something goes wrong.

The most important part is your real identity should NOT be connected to anything about crypto. But we're PLEBS. Those nefarious entities are only after the whales.

   

[Faisal2202]

You will need to give your identity somewhere in the chain of your strategy, and it will be with the application of the P.O. Box with the postal service. That's actually OK because you also know who they are and where their offices are if something goes wrong.

The most important part is your real identity should NOT be connected to anything about crypto. But we're PLEBS. Those nefarious entities are only after the whales.

   

Every time I see your laughing image, I sense you are just trying to soothe your own mind that nothing bad is going to happen! Right! 😅 Well, don't worry, brother, nothing will happen, but you can be sure of it by doing little checks on your past.

Like hackers can only know about you being a whale or pleb if they have your prior data, like exchanges where you held whale-level coins and the data of those exchanges was breached, so they can cross check. You know how it goes, so you can check your past, not just you, anyone could do it to be sure of whether they have used a platform before with an excessive amount, which then reported leaks.

Because maybe you are just a pleb now because BTC is at $77k, it is not going to stay at this range forever. Also, you are not going to hold it forever too, so there are many factors.