Trezor The latest disclosure shows that the scope of the data breach previously caused by logistics service provider ShipMonk has further expanded, with an additional approximately 67,000 American customers being affected. The relevant records involve orders from November 2019 to August 2021, including names, email addresses, phone numbers, home addresses, and order numbers.
As mentioned by Trezor, ShipMonk reported this new batch of exposed data two days ago. The company stated that according to the contract and data policies between the two parties, these records should have been deleted, and they had received multiple written confirmations from the other party before, but the relevant data was ultimately not truly removed.
The number of affected people has risen to approximately 80,700.
When Trezor first disclosed this matter in August of this year, they attributed the impact to a 90-day deletion policy agreed upon with their contract partners. With the confirmation of new data, the number of affected customers has increased from 13,689 to approximately 80,700.
The company stated that all the newly affected users are located in the United States, and the related orders were placed between November 2019 and August 2021; some of these records are nearly 7 years old.
The risks are concentrated in address and identity information.
Trezor indicates that the company's own system has not been compromised, and the hardware devices, private keys, and wallet backups have not been affected. The more significant issue is that the leaked data can be directly linked to the identified holders of the hardware wallets and their home addresses.
The company reminds users to be wary of forged emails, phone calls, and paper letters, and reiterates that wallet backup phrases should not be disclosed to anyone, nor should they be entered on any websites.
In February this year, both users Trezor and Ledger received forged emails. These emails contained holographic logos, QR codes, and forged signatures of senior executives, demanding that users complete a so-called "security check" or risk losing access to their wallets.
The source of the vulnerability points to Metabase.
The report mentioned that this intrusion is related to a severe SQL injection vulnerability in the analysis tool Metabase. This vulnerability was disclosed on August 6th, allowing attackers to steal credentials from connected databases without authentication. In addition to ShipMonk, Framework and Tally were also involved in the same incident.
Trezor also indicates that ShipMonk received a ransom email allegedly from ShinyHunters, but this attribution has not yet been confirmed.
Additional information:According to Trezor, they are accelerating the rollout of an anonymous delivery scheme, which includes self-pickup from lockers, neutral packaging, and generic sender information, in order to reduce the need for users to provide their home addresses.
