Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In August 2026, Trezor told about 13,700 US customers that their names, email addresses, phone numbers and shipping addresses had been stolen in a breach at ShipMonk, a logistics company that had once handled its orders. Weeks later the number rose to roughly 80,700, after the company found the stolen records also covered orders placed between late 2019 and mid-2021. Customers who had bought a wallet five years earlier, and long since forgotten the delivery, were suddenly on a list in the hands of an extortion group.

Attackers rarely start with an exploit. They start with a search: which subdomains a company runs, which staff email addresses sit in breach dumps, which forgotten server still answers on the internet. MITRE ATT&CK treats this stage as a tactic of its own, Reconnaissance, and most of it runs on public data.