The scale of the data breach at hardware wallet provider Trezor is larger than initial estimates: it has affected an additional 67,000 customers in the United States.
The breach may threaten a larger number of users from the U.S. who placed orders between November 2019 and August 2021, Trezor said in a Friday post on X, citing the latest update from its shipping services provider ShipMonk.
The breach exposed the complete data of these customers, including name, email address, phone number, shipping address, and order details. Trezor placed responsibility on the shipping services provider for failing to delete the data for these orders, despite, according to the company, ShipMonk having provided written assurances.
Although Trezor's systems were not compromised, the data leak could pose a threat to the digital assets of the 67,000 customers: malicious actors could use this information for phishing attacks, impersonating Trezor and attempting to steal users' seed phrases which control their wallets.
In August, Trezor initially estimated the number of users whose data was exposed via the shipping provider at just 14,000. In January 2024, Trezor reported that approximately 66,000 users were at risk of phishing attacks if they had contacted the company's support service since December 2021.
Phishing attacks and social engineering do not require exploiting code vulnerabilities. However, according to blockchain security firm Hacken, in the first quarter of the year, impersonation scams accounted for the majority of crypto industry losses: $306 million out of a total of $482 million.
In July, a crypto investor lost nearly $1 million after signing a malicious token approval transaction on the Ethereum network.
Related: Thai businessmen sue Tether over freezing of $42M in $61M pig butchering fraud case
end-content
