Trezor says data breach affects another 67K US customers

Hardware wallet manufacturer Trezor has notified an additional 67,000 U.S.-based customers that their personal information was exposed following a security incident involving a third-party logistics vendor. The breach compromises customer contact details, order histories, and physical delivery addresses collected during the fulfillment process. Crucially, Trezor emphasized that the core security of its hardware devices, underlying cryptographic keys, and the Trezor Suite application remains uncompromised, as recovery seed phrases and private keys are generated and stored isolated on-device, completely detached from customer-facing e-commerce servers. Despite the cryptographic integrity of the physical units, the exposure of off-chain metadata introduces severe digital and physical vectors for targeted exploitation. Armed with real names, delivery addresses, and confirmed hardware wallet ownership status, malicious actors gain the precise telemetry required to deploy sophisticated social engineering schemes. Threat actors routinely use this data to orchestrate highly convincing phishing campaigns—such as sending fake support emails or physical letters urging users to download compromised firmware or input their 12-to-24-word recovery seeds on fraudulent verification sites. More alarmingly, physical address exposure heightens targeted coercion risks for self-custody advocates, exposing high-net-worth investors to physical threats and home invasion vulnerabilities. This breach underscores an enduring paradox within the crypto ecosystem: while on-chain assets are protected by robust cryptographic algorithms and air-gapped hardware, traditional Web2 supply chains and vendor databases remain vulnerable single points of failure. The industry has confronted similar fallout before, most notably following Ledger’s 2020 marketing database leak, which triggered years of persistent SMS phishing, extortion threats, and rogue hardware units mailed directly to victims' homes. Trezor’s latest breach highlights how fragile the operational bridge remains between privacy-focused decentralized finance and conventional third-party logistics networks. Market sentiment across privacy-focused crypto communities has turned sharply critical, re-igniting debate over data retention policies enforced by hardware vendors. Users are increasingly demanding that hardware manufacturers adopt zero-knowledge checkout options, immediate order data purging, and support for decentralized fulfillment systems to eliminate single points of compromise. In the interim, security analysts advise impacted customers to maintain extreme operational vigilance: ignore unsolicited communications claiming to originate from Trezor, verify all software downloads exclusively through official signed repositories, and utilize burn-out contact info or P.O. boxes for future hardware acquisitions. The incident serves as a stark reminder that in self-custody, safeguarding private keys is only half the security equation—protecting the off-chain footprint surrounding those keys is equally vital.