[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftfjHrC41_lukcvf8-QzOLg6Cci-W4pWOMO9kmSZesl4":3,"$fBzSPX_x2nnQ6h3pnZ_78L_OIrP3vQPavnMIriKOZ_Y0":47},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":44,"created_at":45,"updated_at":46,"published_at":24},"trezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers","Trezor Confirms Data Breach at ShipMonk Affecting 14,000 Customers","Hackers exploited a Metabase vulnerability to access customer data held by the third-party shipping provider.","Trezor has confirmed that its third-party shipping partner, ShipMonk, suffered a data breach impacting 14,000 customers after attackers leveraged a SQL injection flaw in the Metabase platform.",[10,11,12,13,14],"Data Breach","ShinyHunters","Trezor","ShipMonk","Metabase","# Trezor Confirms Data Breach at ShipMonk Affecting 14,000 Customers\n\n*Hackers exploited a Metabase vulnerability to access customer data held by the third-party shipping provider.*\n\n**Tags:** `Data Breach` `ShinyHunters` `Trezor` `ShipMonk` `Metabase`\n\n> Trezor has confirmed that its third-party shipping partner, ShipMonk, suffered a data breach impacting 14,000 customers after attackers leveraged a SQL injection flaw in the Metabase platform.\n\n---\n\n## Trezor confirms customer data exposure\n\nTrezor has formally notified customers that their personal information was accessed by unauthorized parties. The breach impacts approximately 14,000 individuals who utilized the company’s hardware cryptocurrency wallets. According to available details, the intrusion occurred through a vulnerability in Metabase, a data analytics platform used within the supply chain. This incident underscores the security risks inherent in relying on third-party logistics and software partners within the cryptocurrency ecosystem.\n\n## The ShipMonk and Metabase connection\n\nThe intrusion into Trezor’s customer records was facilitated through a vulnerability in Metabase, the data analytics platform utilized by ShipMonk. The specific flaw exploited is believed to be a SQL injection zero-day that Metabase addressed with a patch last week. While ShinyHunters has claimed responsibility for attacks targeting Metabase and subsequently leaked data from the provider, ShipMonk has not yet publicly acknowledged the incident or disclosed further details regarding how its systems were compromised.\n\n## ShinyHunters claims responsibility\n\nThe ShinyHunters extortion group has claimed responsibility for the intrusion into Metabase, a data analytics platform that served as the entry point for the recent breach affecting Trezor customers. On Wednesday, the threat actor published data it alleges was stolen from the provider on its dark web leak site.\n\nThis incident aligns with ShinyHunters’ established operational pattern of targeting third-party integrations and service providers to access sensitive customer information. The group has previously leveraged similar tactics in campaigns against Salesforce customers, Snowflake clients, and other unified communications platforms, often exploiting vulnerabilities in intermediary software rather than the primary targets themselves.\n\n## Key points\n\n- Trezor notified customers that hackers accessed their data by exploiting a vulnerability in Metabase, the analytics platform used by its shipping provider ShipMonk.\n- The incident affected approximately 14,000 Trezor customers whose personal information was compromised through the third-party service.\n- ShinyHunters claimed responsibility for the attack on Metabase and subsequently leaked data allegedly stolen from the analytics solutions provider.\n- ShipMonk has not yet publicly acknowledged the specific incident affecting its client base, leaving details of the breach's scope within their systems unclear.\n\n## Further reading & sources\n\n- [14,000 Trezor Customers Impacted by Data Breach at ShipMonk - SecurityWeek](https:\u002F\u002Fwww.securityweek.com\u002F14000-trezor-customers-impacted-by-data-breach-at-shipmonk) — SecurityWeek\n- [1.6 Million Likely Impacted by RingCentral Data Breach - SecurityWeek](https:\u002F\u002Fwww.securityweek.com\u002F1-6-million-likely-impacted-by-ringcentral-data-breach) — SecurityWeek\n- [RingCentral data breach exposed info of 1.6 million accounts](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fringcentral-data-breach-exposed-info-of-16-million-accounts) — BleepingComputer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers.png?v=f8ae5b52ce",{"actors":18,"targets":25,"industries":34,"technologies":38},[19],{"url":20,"name":21,"slug":21,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fshinyhunters","shinyhunters","ransomware","Russia",null,[26,30,32],{"name":27,"sector":28,"status":29,"geography":24},"RingCentral","Technology","confirmed",{"name":13,"sector":31,"status":29,"geography":24},"shipping provider",{"name":12,"sector":33,"status":29,"geography":24},"Hardware crypto wallet provider",[35],{"url":36,"name":28,"slug":37},"\u002Findustries\u002Ftechnology","technology",[39,41,42],{"vendor":27,"product":40},"unified communications and contact center solutions",{"vendor":14,"product":14},{"vendor":27,"product":43},"cloud-based collaboration and communication platform","breach","2026-08-18T17:57:49.084977+00:00","2026-10-16T12:29:27.822249+00:00",{"articles":48},[49,60,71,84],{"slug":50,"title":51,"summary":52,"tags":53,"hero_image_url":58,"story_type":44,"created_at":59},"exposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities","Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities","CRM provider Beacon attributes a breach impacting around 1,500 UK charities to a compromised AWS access key that was likely exposed during software development, leading to the exfiltration of supporter personal data.",[54,10,55,56,57],"AWS","Charities","Beacon CRM","Credential Exposure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fexposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities.png?v=ec1f5046ce","2026-08-18T14:16:09.055717+00:00",{"slug":61,"title":62,"summary":63,"tags":64,"hero_image_url":69,"story_type":44,"created_at":70},"france-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims","France's DGFiP Confirms Breach After Hacker ZeroBytes Claims 600,000 Victims","French authorities are investigating a breach of the Directorate General of Public Finances (DGFiP) after hacker ZeroBytes claimed to have stolen data on over 600,000 individuals and businesses.",[65,66,67,10,68],"France","DGFiP","ZeroBytes","Government Security","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrance-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims.png?v=fc9efd493d","2026-08-18T08:44:35.455344+00:00",{"slug":72,"title":73,"summary":74,"tags":75,"hero_image_url":81,"story_type":82,"created_at":83},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[76,77,78,79,14,80],"Head Mare","zero-day","Atlassian Rovo","Progress LoadMaster","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","vulnerability_disclosure","2026-09-22T12:04:22.141581+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":94,"story_type":95,"created_at":96},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","ShinyHunters Bypasses MFA With Salesforce OAuth Playbook","Cato Networks publishes a 2026 threat-actor profile for ShinyHunters, detailing its MFA-bypass playbook (help-desk vishing + malicious Salesforce connected app + OAuth token) and the UNC6040 campaign that targets Salesforce, Salesloft Drift, and Gainsight integrations.",[11,89,90,91,92,93],"Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","threat_actor_activity","2026-09-05T07:16:15.004025+00:00"]