Trezor Data Breach Expands to 80,689 Customers; ShipMonk Retention Failure Confirmed

Shipping Partner Identified as Source of Data Retention Failure

Trezor's third-party shipping partner ShipMonk retained customer data well beyond the agreed 90-day deletion window, according to reporting from Bitcoin Magazine and earlier coverage by CryptoPotato and Decrypt. The discovery identifies a specific vendor responsible for the data retention failure that contradicted Trezor's public statements about data handling practices.

Scale and Timeline of Exposure

The confirmed customer data breach has grown to approximately 80,689 affected individuals, according to CryptoSlate reporting on newly discovered shipping logs. The expanded figure represents a sixfold increase from Trezor's initial disclosure and includes records dating back to 2019—contradicting the company's stated policy that data partners would retain customer information for a maximum of 90 days. The presence of older records and the discovery of shipping logs that were supposedly deleted raise questions about what data still exists at other points in Trezor's vendor ecosystem.

Trezor has not published a detailed timeline of when it discovered ShipMonk's retention failure, disclosed which customer categories were newly confirmed as exposed, or provided a row-level overlap check to determine whether the 80,689 figure includes duplicates across multiple reported breaches.