Cryptocurrency wallet manufacturer Trezor announced a data breach affecting 14,000 users.

Trezor, a cryptocurrency hardware wallet manufacturer, reported a breach of its third-party partner, logistics provider ShipMonk.

As a result of the breach, all or partial data of approximately 14,000 Trezor customers was leaked to attackers. The leak compromised the names, email addresses, phone numbers, and shipping addresses of 11,742 customers. The names, cities, and email addresses of another 1,947 users were exposed. The victims were users from the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.

Trezor assured that the incident did not affect the company's internal systems, and that the hardware wallets themselves remain secure. However, it warned that the affected users are now at increased risk. Attackers can use the data for phishing attacks, contacting these people, posing as representatives of Trezor, banks, or crypto exchanges, to trick them into revealing more sensitive information and convincing them to transfer assets.

In January, customers of another major cold wallet manufacturer, Ledger, also experienced a leak of names and contact information—also following unauthorized access to order data stored by third-party e-commerce provider Global-e. In 2020, Ledger suffered its first major breach, when attackers obtained information on more than 270,000 customers—including names, email addresses, phone numbers, and, in some cases, home addresses. This data was later posted on a hacker forum, leading to a wave of phishing attacks and harassment against Ledger users.

The Trezor data breach occurred shortly after a series of attacks on Coldcard hardware wallets. In total, during four waves of attacks, cybercriminals were able to steal at least 1,767 bitcoins.