People buy a Trezor to keep their private keys off the network, out of anyone's sight. But what got exposed this time wasn't the private key—it was "who bought it" and "where it was shipped."
Trezor confirmed that its shipping partner ShipMonk suffered a data breach affecting the personal information of nearly 14,000 hardware wallet customers, some of which included actual shipping addresses. In other words, what got breached wasn't the wallet firmware or the seed phrase storage mechanism—it was the third-party logistics company responsible for getting packages to your door.
For hardware wallet owners, the sensitivity of this kind of data isn't about usernames or passwords—it's the "address" itself that becomes a clue, indirectly pointing to who might be holding a significant amount of crypto assets and where that person lives. Cold wallets are designed specifically to minimize this exact kind of exposure, yet the shipping process bypassed the entire security model, laying names and addresses bare in a breached database.
What's publicly known so far is limited to this: the number of affected users, how the breach occurred, and the fact that some addresses were exposed. The exact timing of the breach, what other personal data fields were involved, and what remediation steps Trezor or ShipMonk will offer going forward have yet to be officially detailed.
