Trezor confirms customer data exposure
Trezor has formally notified customers that their personal information was accessed by unauthorized parties. The breach impacts approximately 14,000 individuals who utilized the company’s hardware cryptocurrency wallets. According to available details, the intrusion occurred through a vulnerability in Metabase, a data analytics platform used within the supply chain. This incident underscores the security risks inherent in relying on third-party logistics and software partners within the cryptocurrency ecosystem.
The ShipMonk and Metabase connection
The intrusion into Trezor’s customer records was facilitated through a vulnerability in Metabase, the data analytics platform utilized by ShipMonk. The specific flaw exploited is believed to be a SQL injection zero-day that Metabase addressed with a patch last week. While ShinyHunters has claimed responsibility for attacks targeting Metabase and subsequently leaked data from the provider, ShipMonk has not yet publicly acknowledged the incident or disclosed further details regarding how its systems were compromised.
ShinyHunters claims responsibility
The ShinyHunters extortion group has claimed responsibility for the intrusion into Metabase, a data analytics platform that served as the entry point for the recent breach affecting Trezor customers. On Wednesday, the threat actor published data it alleges was stolen from the provider on its dark web leak site.
This incident aligns with ShinyHunters’ established operational pattern of targeting third-party integrations and service providers to access sensitive customer information. The group has previously leveraged similar tactics in campaigns against Salesforce customers, Snowflake clients, and other unified communications platforms, often exploiting vulnerabilities in intermediary software rather than the primary targets themselves.
Key points
- Trezor notified customers that hackers accessed their data by exploiting a vulnerability in Metabase, the analytics platform used by its shipping provider ShipMonk.
- The incident affected approximately 14,000 Trezor customers whose personal information was compromised through the third-party service.
- ShinyHunters claimed responsibility for the attack on Metabase and subsequently leaked data allegedly stolen from the analytics solutions provider.
- ShipMonk has not yet publicly acknowledged the specific incident affecting its client base, leaving details of the breach's scope within their systems unclear.
Further reading & sources
- 14,000 Trezor Customers Impacted by Data Breach at ShipMonk - SecurityWeek — SecurityWeek
- 1.6 Million Likely Impacted by RingCentral Data Breach - SecurityWeek — SecurityWeek
- RingCentral data breach exposed info of 1.6 million accounts — BleepingComputer