An updated disclosure says roughly 67,000 additional U.S. customers were exposed after historical shipping data remained at a supplier despite written deletion assurances.
Trezor said on September 4 that the ShipMonk breach disclosed August 13 also exposed order records from November 2019 through August 2021. It learned of the expansion September 2. The additional records included names, email addresses, phone numbers, shipping addresses and order numbers, according to the update. Trezor’s update
The company said the supplier retained those records despite written deletion confirmations. It emailed affected customers and warned of phishing using exposed contact and delivery details. Trezor reported that ShipMonk secured its systems and that Trezor systems and devices were unaffected. Incident notice
Trezor describes unauthorized access at the shipping provider; its notice does not identify the intruder or explain how access was gained. Trezor’s account
For a business reviewing a similar supplier, Layer8’s Phantom Assurance could assess retention evidence and turn gaps into findings, unresolved questions, owners and next steps. A focused review would ask which order datasets remain, whether deletion records cover earlier contracts, and who is accountable for correcting unsupported assurances.
Verification would compare the supplier’s obligations with dated evidence of completed deletion or anonymization and documented exceptions. Any period or dataset without support would stay open in the assessment, with a responsible owner and a requirement for follow-up evidence. Implementation would be scoped separately. Confirmed removal of unnecessary records could reduce a future breach’s reach; an assessment alone cannot establish that removal or guarantee prevention.