2026 Trezor — ShipMonk fulfillment breach; ~80.7k customers after Sep update (+~67k legacy US)

Verified Trezor notices and BleepingComputer — August–September 2026. ShipMonk informed Trezor August 10 of unauthorized access; Trezor disclosed ~13,689 customers August 13. September update: another ~67,000 U.S. customers (orders Nov 2019–Aug 2021) exposed after ShipMonk retained data despite repeated written deletion assurances. Combined impact ~81,000 / catalog 80,689. Metabase vulnerability path cited in customer emails; ShinyHunters extortion emails to ShipMonk reported by BC. Trezor systems/devices not compromised. Physical-security and phishing risk emphasized. recordsAffected 80689; companyConfirmed true. Update September 2026: Help Net Security and Trezor’s own warnings note the leaked ShipMonk contact data (names, emails, phones, shipping addresses) is already being abused for phishing emails, fraudulent calls, and letters — heightened physical-security risk for hardware-wallet owners. This is abuse of fulfillment-contact data from the ShipMonk Metabase path, not a separate confirmed compromise of Trezor’s own mail infrastructure. Devices/seeds remain unaffected per Trezor.