Trezor Discloses Data Breach Affecting Nearly 14,000 Customers via Shipping Vendor

Trezor, a leading manufacturer of cryptocurrency hardware wallets, announced Thursday that a data breach at one of its third-party shipping providers has exposed the personal information of nearly 14,000 customers. The company confirmed that its own systems and the security of its hardware wallets were not compromised in the incident.

Details of the Exposure

The Prague-based company stated that the breach affected customers who had received an order in the 90-day period leading up to Aug. 8. The exposed data varies in scope:

• 11,742 customers had their full names, shipping addresses, email addresses, and phone numbers compromised.
• An additional 1,947 customers had partial personal data exposed.

The incident impacted customers across several countries, including the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor noted that it had already deleted older customer shipping data as part of its standard procedures.

Heightened Risk of Phishing and Physical Threats

Ad

While Trezor's devices remain secure, the company warned that the compromised personal data significantly increases the risk of sophisticated phishing attempts against affected users. Malicious actors could use the information to craft highly targeted and convincing scams to try and steal users' crypto assets.

Furthermore, the exposure of physical addresses raises concerns about the potential for physical attacks. According to a report from security firm CertiK, there were approximately 52 physical attacks on cryptocurrency holders globally in the first half of 2026, a 33% increase from the same period in 2025, highlighting a growing trend of real-world threats.

Company Response and Industry Context

Trezor acknowledged the severity of the situation in an emailed statement. "We absolutely understand how serious this is and the potential risks it poses to our customers and are deeply sorry to those affected," the company said.

This incident underscores the security vulnerabilities present in the supply chains of even the most secure hardware companies. It follows a similar breach reported by Coinkite Inc., another hardware wallet manufacturer, demonstrating a recurring challenge for the industry in protecting customer data held by third-party vendors.