Trezor has disclosed that a data breach involving its third-party logistics provider, ShipMonk, exposed information relating to approximately 67,000 additional U.S. customers. The affected records relate to orders placed between 2019 and 2021 and include names, email addresses, telephone numbers, shipping addresses and order numbers.

The incident is particularly significant because the affected customers are users of cryptocurrency hardware wallets. Exposure of shipping and contact information can create heightened phishing, impersonation and physical-security risks for users who may hold valuable digital assets.

Trezor has stated that its own systems were not compromised and that the incident occurred at the third-party logistics provider. The incident illustrates the privacy and security risks associated with third-party vendors retaining historical customer information long after the underlying transaction has taken place.