Data Breaches · Phishing / BEC

ShipMonk breach broke Trezor's deletion assumption

Trezor said a breach at shipping provider ShipMonk exposed personal and order data for another 67,000 U.S. customers, even though Trezor had been told the older records were deleted. The newly disclosed set includes names, email addresses, phone numbers, shipping addresses, and order numbers from purchases between November 2019 and August 2021.

The intrusion at ShipMonk was tied to zero-day exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase. In plain terms, the attacker was able to query the backend database through the analytics app and pull data the shipper still held, so Trezor's deletion policy did not eliminate the copy that mattered once ShipMonk was breached.

The exposure sits with any company that hands customer data to processors and assumes a retention promise equals removal. If a vendor keeps historical records longer than the contract suggests, a later breach can widen the blast radius long after the brand thinks that data is gone.

3 sources · Sep 8

CVE-2026-72898

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database…

CISA federal remediation date Aug 14 · date passed

Timeline

Sources

Part of the PlainSec briefing for 2026-09-09

Every edition of this story: ShipMonk breach broke Trezor's deletion assumption

More from today