Not a law firm.We connect people affected by data breaches with independent attorneys.

Incident information

Trezor Customer Affected by the ShipMonk Data Breach? Learn About Your Options

Information about this incident and a simple way to see if you may qualify to be connected with independent attorneys.

What happened

ShipMonk, the third-party fulfillment and shipping provider used by Trezor for hardware wallet orders, experienced a data breach through an SQL injection attack involving Metabase, attributed to the ShinyHunters group and discovered around August 8–10, 2026. Trezor notified approximately 13,689 customers (reported as about 14,000), with full exposure for 11,742 individuals, covering orders placed or received between May 10 and August 8, 2026.

Exposed data included:

Full names
Physical shipping/home addresses
Email addresses
Phone numbers
Order numbers and related purchase details

Trezor notified affected users and provided general security advice; according to the original reports, it did not offer compensation or credit monitoring. Customers in the US, UK, EU and other regions have expressed concern about targeted phishing. No class action had been filed as of the original report.

Possible remedies

Possible remedies, if any, depend on the facts of your situation and applicable law. No outcome or payment is guaranteed.

Official source

Read the original public notice or report about this incident (opens in a new tab):

https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

See if you may qualify

Were you a Trezor customer during the affected period? See if you may qualify to connect with an independent attorney.

First nameLast nameEmail addressPhone (optional)State of residenceBriefly describe how you were affected (optional)

Optional. Please do not include Social Security numbers, dates of birth, account numbers, or medical details.

I agree to the Terms and Privacy Policy and consent to DataBreachRelief.com sharing my information with one or more independent law firms, who may contact me about my potential claim by email or phone. I understand this does not create an attorney-client relationship.Optional: I agree to receive calls/texts, including automated, from DataBreachRelief.com and partner law firms at the number provided. Consent is not a condition of service. Msg & data rates may apply. Reply STOP to opt out.

Thank you. Your information has been received. If a participating law firm is interested in your situation, they may contact you.

Sorry, something went wrong and your information was not sent. Please try again.

DataBreachRelief.com is not a law firm and does not provide legal advice. We are an independent information and referral service. Information you submit may be shared with one or more independent law firms that may contact you about your potential claim. Submitting information does not create an attorney-client relationship. Listing an incident does not mean a lawsuit has been filed, and no outcome is guaranteed. Attorneys who receive referrals may pay us a fee for advertising or lead services.