As reported by The Hacker News, Trezor's disclosure that an additional 67,000 U.S. customers were exposed in the ShipMonk breach — on top of the 13,689 revealed last month — is less a story about a logistics vendor getting hacked and more a damning case study in why third-party data retention assurances mean nothing without cryptographic proof of deletion. Trezor reportedly received written confirmation that customer data had been purged per its 90-day policy. It wasn't. That data, stretching back to 2019, sat in ShipMonk's environment for years waiting to be scooped up.
The Technical Root Cause
The breach vector matters as much as the governance failure. ShipMonk was compromised through the exploitation of CVE-2026-72898, a critical SQL injection vulnerability in Metabase scored at CVSS 10.0. This is a textbook example of an analytics and BI tool becoming the soft underbelly of an organization's security posture — Metabase instances are often internet-exposed, under-monitored, and hold credentials that reach deep into production databases.
| Field | Detail |
|---|---|
| CVE | CVE-2026-72898 |
| CVSS | 10.0 (Critical) |
| Type | SQL Injection |
| Affected Product | Metabase (BI/analytics platform) |
| Threat Actor | ShinyHunters (extortion gang, per Holborn) |
| Exploitation Status | Active exploitation observed in the wild |
| Victim | ShipMonk (third-party logistics provider) |
| Downstream Impact | Trezor — ~80,689 customers total (67,000 + 13,689) |
Why This Is Worse Than a Typical Breach
The victim population here is what elevates this incident. These are people who purchased hardware cryptocurrency wallets — a demographic that is, by definition, holding digital assets of meaningful value. The exposed dataset includes shipping addresses and phone numbers, which means attackers now have a curated hit list of potentially high-net-worth crypto holders mapped to physical locations. This is not abstract data exposure; it's a targeting package.
The combination of confirmed crypto ownership, physical address, and phone number creates a convergence of digital and physical attack surface that few breaches produce.
ShinyHunters is a known and capable extortion group with a history of breaching SaaS platforms and monetizing stolen data through sale and leverage. Their involvement suggests this data will not simply sit idle — it will be used for highly tailored social engineering campaigns, SIM-swap precursor reconnaissance, and potentially physical attacks against high-value targets, a trend documented in multiple violent crypto robbery cases over recent years.
The Deletion Assurance Fallacy
The most important lesson here isn't about Metabase or ShipMonk specifically. It's about the fundamental unreliability of vendor self-attestation regarding data deletion. Trezor did what many companies do — it had a data retention policy, communicated it to its vendor, and received written confirmation of compliance. None of that prevented the data from persisting on ShipMonk's infrastructure for years beyond the agreed retention window.
This is a structural problem. Data deletion in complex enterprise environments is extraordinarily difficult to verify. Backup tapes, analytics replicas, data warehouse ETL pipelines, log aggregators, and BI tool caches all create shadow copies that persist long after the "primary" record is deleted. A vendor confirming deletion in their CRM or order management system tells you nothing about the seventeen other places that data may live.
Shield53 Recommendations
- Patch Metabase immediately. If your organization runs Metabase, treat CVE-2026-72898 as a P0 emergency. Isolate the instance behind a VPN or zero-trust access layer, restrict database account privileges to read-only with row-level security, and audit all query logs for SQL injection patterns dating back at least 12 months.
- Audit your third-party data footprint. Don't ask vendors whether they deleted your data — demand evidence. Request database query logs, backup retention schedules, and data flow diagrams showing every system that ingested the data. If a vendor cannot produce this, assume the data persists.
- Implement data minimization at the API layer. The most effective way to prevent third-party data exposure is to never send it in the first first place. Use pseudonymized customer IDs with shipping providers. Let the provider hold a delivery token, not a name and phone number. Re-identification happens only within your own controlled environment.
- For Trezor customers specifically: Assume your shipping address and contact details are now in adversary hands. Enable hardware security keys on all exchange and wallet accounts. Be suspicious of any unsolicited communication referencing your Trezor purchase — including physical mail. Consider a mail forwarding service if your home address was exposed and you hold significant crypto assets.
- Monitor for SIM-swap indicators. With phone numbers exposed, affected customers should contact their mobile carriers to enable port-out PINs and account-level security freezes. SIM-swap attacks remain a primary vector for crypto theft.
- Reassess your vendor risk management program. Written attestations are compliance theater. Move toward continuous monitoring, evidence-based controls validation, and contractual penalties that create real financial consequences for data retention violations.
The ShipMonk incident should end the practice of trusting vendors at their word on data deletion. In a threat landscape where a single CVSS 10.0 vulnerability in an analytics tool can expose years of supposedly purged records, defenders need to operate on the assumption that any data shared with a third party is permanent — and plan accordingly.
