Trezor Discloses Expanded ShipMonk Breach via Metabase Zero-Day

A critical supply chain intrusion known as the Trezor ShipMonk data breach has exposed the personal details of 67,000 additional U.S. hardware wallet customers. Hardware wallet manufacturer Trezor disclosed that its third-party logistics and fulfillment partner, ShipMonk, suffered unauthorized access to internal analytics systems storing customer order archives.

ShipMonk first notified Trezor of the security incident on August 10, 2026. While Trezor initially reported last month that 13,689 customers had experienced full or partial data exposure—including 1,947 whose records were limited to names, cities, and email addresses—subsequent investigation revealed a much broader breach window. The newly identified dataset contains sensitive personal identifiable information (PII) for orders placed between November 2019 and August 2021, including full customer names, email addresses, phone numbers, physical shipping addresses, and order numbers.

The exposure occurred despite explicit contractual obligations governing data retention. Trezor maintains a strict 90-day data retention policy for its eShop orders—the minimum period required to process deliveries, returns, and customer support queries—after which customer data must be deleted or anonymized. Trezor confirmed it repeatedly requested and received written assurance from ShipMonk confirming that historical records had been purged. However, ShipMonk failed to execute the data deletion across its internal storage systems. Trezor emphasized that the breach is isolated strictly to fulfillment databases and has no impact on the cryptographic security, seed phrases, or firmware of Trezor hardware wallets.

Technical Vector: Exploiting the CVE-2026-72898 Metabase Zero-Day

The initial entry point into ShipMonk’s network was driven by the zero-day exploitation of CVE-2026-72898, a critical SQL injection vulnerability in Metabase carrying a maximum CVSS score of 10.0. Metabase is a widely deployed open-source business intelligence and data visualization application that connects directly to backend enterprise production databases to generate dashboards and operational reports.

SQL injection flaws occur when application interfaces fail to sanitize or parameterize user-supplied inputs before passing them into structured database queries. In the context of business intelligence tools like Metabase, an unauthenticated SQL injection vulnerability allows external attackers to bypass authentication, construct arbitrary database calls, and query underlying relational databases directly. Attackers exploiting CVE-2026-72898 were able to exfiltrate table contents, access archived order management databases, and extract sensitive customer fields stored within ShipMonk’s Metabase analytics instance. ShipMonk has since secured the affected infrastructure and hardened its internal environment.

Threat Actor Profile: ShinyHunters

Blockchain security firm Holborn attributed the attack to ShinyHunters, a prolific cybercrime and extortion group active since 2020. ShinyHunters is widely recognized for targeting cloud-hosted infrastructure, databases, and third-party SaaS vendors to conduct mass exfiltration campaigns.

Unlike traditional ransomware operators who focus on encrypting systems to halt operations, ShinyHunters primarily operates as a data theft and extortion syndicate. The group typically scans public-facing internet infrastructure for zero-day vulnerabilities or misconfigured database instances, steals sensitive customer databases, and contacts affected organizations demanding ransom payments under threat of public disclosure. If extortion demands are unmet, the group leaks or sells the compromised datasets on cybercrime marketplaces, where the records are subsequently acquired by secondary threat actors specializing in financial fraud and social engineering.

Blast Radius and Specific Risks for Cryptocurrency Users

While standard corporate data breaches expose victims to generic spam, data leaks involving hardware wallet manufacturers carry an elevated threat profile. Stolen lists of hardware wallet purchasers serve as a verified directory of individuals holding self-custodied cryptocurrency assets, making affected users primary targets for highly targeted attacks:

• Physical Security Risks: The exposure of physical home addresses combined with full names creates tangible real-world safety risks, including home invasion, physical extortion, or fraudulent physical mailers sent to victims’ homes containing backdoored hardware devices designed to extract recovery seeds.
• Targeted Phishing and Impersonation: Attackers leverage exact purchase dates, order numbers, and contact details to craft highly believable email and SMS phishing campaigns. Threat actors often impersonate Trezor support personnel, claiming that a wallet security update or device recall requires users to enter their 12- or 24-word recovery seed on a malicious portal.
• SIM Swapping and Social Engineering: Leaked phone numbers and email addresses enable attackers to attempt SIM swaps against cellular carriers, hijacking phone numbers to intercept SMS-based multi-factor authentication codes and gain access to exchange accounts.

Mitigation and Defense Recommendations

This incident underscores the inherent risks in software supply chains and third-party vendor data retention. Security teams and affected users should implement the following targeted measures:

For Organizations and Metabase Administrators

• Patch Metabase Installations: Ensure all Metabase instances are immediately updated to the latest patched release to remediate the CVE-2026-72898 SQL injection vulnerability.
• Restrict BI Application Exposure: Public BI and analytics instances should never be directly accessible from the open internet. Place Metabase and similar tools behind a Web Application Firewall (WAF), require VPN access, or restrict access via strict IP allowlists.
• Database Least Privilege: Enforce minimal privilege models for database service accounts used by reporting tools. Read access should be constrained strictly to active operational tables, and legacy analytics stores should use anonymized or tokenized data fields.

For Impacted Trezor Customers

• Never Disclose Recovery Seeds: Trezor will never ask for your recovery seed phrase via email, phone, paper mail, or software prompts. Never enter your seed phrase anywhere except directly on your physical Trezor device screen.
• Heightened Vigilance: Treat all unsolicited calls, letters, or emails regarding Trezor orders, hardware updates, or account suspensions as malicious. Verify communications independently through official channels.