2026-08-20autoTrezor published an official 2026-08-13 blog naming ShipMonk as the breached fulfillment partner and restating 11,742 full-address records plus 1,947 partial; devices and firmware remain unaffected. After the first post, Trezor said the 1,947 partial cohort (name/city/email only) may include older-than-90-day orders…
2026-09-07Trezor disclosed that ShipMonk had kept records it was required to delete; about 67,000 additional US customers affected, bringing the total to roughly 81,000. Data exposed: names, shipping addresses, emails, phone numbers. Devices and firmware unaffected.
2026-09-11Separate breach at Brevo, Trezor's newsletter provider: about 347,000 subscribers received a phishing email titled "Critical Security Alert: STM32 Entropy Vulnerability"; about 2,500 clicked before the malicious site was taken offline roughly 20 minutes after detection.
Solid pick. Verified working but with a meaningful caveat (UX rough, smaller market, intermediate trust step, partial coverage). Listed because the trade-off is sometimes worth it.
▸未解決資安事件 (2026-08-13):A third-party shipping provider used by Trezor (ShipMonk) was breached, exposing full names, phone numbers, email addresses and shipping addresses. Trezor's first count (2026-08-13) was 11,742 customers with full exposure plus 1,947 partial; on 2026-09-07 it disclosed that ShipMonk had failed to delete older records as required, adding about 67,000 US customers and bringing the total to roughly 81,000. Separately, attackers compromised Brevo, the service Trezor uses for newsletters, and on 2026-09-11 sent about 347,000 Trezor subscribers a fake "Critical Security Alert: STM32 Entropy Vulnerability" email; about 2,500 people clicked before the phishing site was taken down roughly 20 minutes later. Trezor firmware and devices are not affected: both incidents sit in Trezor's vendors, not its hardware. The risk to readers is twofold: convincing phishing that now knows you own a Trezor, and home addresses of confirmed crypto holders circulating, which is a physical-safety problem, not just an inbox one.