Three leaks, one pattern. What escapes from a company is almost never the data that moves your coins. It is the data that makes someone credible enough to ask you for it. Part of Know the Scam by SimpleSwap.

On August 13, Trezor told roughly 14,000 customers their personal details had been exposed. Not through Trezor, but through ShipMonk, the logistics provider that packs and ships its hardware.

The company was precise about what did not happen. Its systems were not compromised. The devices are secure. No seed phrase, no key, no firmware. 11,742 customers had full exposure of name, email, phone number, and shipping address, with 1,947 partially exposed.

By the usual measure, minor. No funds moved; nothing was hacked.

That reading is the mistake, and it is what this piece is about.

One data point is nothing. The combination is everything.

The standard reaction to breach news is a shrug. My email and phone number have been out there for years. And taken alone, that is correct: a phone number decides nothing, a name decides nothing, a city decides nothing.

Value appears when fields are joined.

Your phone number, your name, the fact that you bought a hardware wallet six weeks ago, and the street it shipped to are not four harmless facts. It is a qualified list of confirmed crypto holders, sorted by purchase recency, and it preemptively removes every friction point that normally causes an impersonation attempt to fail.

Trezor’s own warning named three channels: email, phone, and post. The third one matters because physical mail becomes possible when addresses are leaked, and it carries the authority that an email lost a decade ago.

Three leaks in crypto, three different failures

Trezor, August 2026: the vendor. The breach happened at a logistics partner, not at the company whose name is on the box. Trezor’s ninety-day retention limit with that partner measurably reduced the blast radius, which is a real argument for buying from companies that keep less.

Ledger, 2020, and again in January 2026: the long tail. The 2020 breach exposed data on more than 270,000 customers, which was published on a hacking forum. Six years later, customers still report calls and printed letters from fraudsters impersonating the company. Some arrived with counterfeit hardware wallets mailed to the victim’s home, pre-loaded to compromise anyone who set one up. Then, in January 2026, another notification was received following unauthorized access to a third-party e-commerce provider. Leaked data does not expire; it gets resold and recombined.

The 149-million dump, January 2026: no company at all. A researcher found an unsecured database of roughly 149 million stolen credentials, about 96GB in size, sitting openly online, including around 420,000 Binance login records, 48 million Gmail accounts, and 17 million Facebook accounts. Binance was not breached. Neither was Google. The credentials came off infected user devices, harvested one at a time by infostealer malware that read saved browser passwords, session cookies, autofill data, and wallet extension files.

That third case is the category shift worth internalizing. Attacking a company is expensive and gets noticed. Infecting a hundred thousand people through fake game mods, cracked software, and malicious browser extensions is cheap and goes unnoticed by anyone. One infected machine exposes every account it logs into, which is why these dumps mix email, banking, and exchange credentials in one file. And stolen session cookies bypass two-factor authentication outright because a session token represents a login that has already occurred.

What your data is actually used for

Fraud. Personalized datasets make phishing nearly frictionless. The sender knows your name, your city, and your recent purchase, so the message reads as routine.

Stalking and harassment. Photos, social profiles, contacts, and locations are already in circulation. The work is knowing where to look.

AI profiling. Services now compile reputation portraits from public and leaked material, scoring whether a person is reliable or risky and selling the conclusion as analytics. Whitebridge AI is one example of the category. You may not know such a profile exists, and there is little practical way to correct it.

So a leak today means more than lost privacy. Systems are forming opinions about you from this material, and that process is largely outside your reach.

The part that is no longer only digital

CertiK recorded around 52 physical attacks on crypto holders worldwide in the first half of 2026, up 33% year-over-year. Chainalysis reported that more than $30 million was stolen in violent attacks over the same period, on pace to exceed 2025’s full-year total of $58 million.

A shipping address tied to a hardware wallet purchase links crypto ownership to a physical location. This year, a French couple was reportedly targeted in three home invasions within a month after moving into a house once owned by crypto millionaires whose address had leaked. They held nothing. The address was the target.

What to do

Assume the data is out. You cannot un-leak an address. You can change what an accurate detail is worth.

Treat product knowledge as worthless proof of identity. Someone knowing your wallet model, purchase date, and street proves they read a database, not that they work anywhere.

Never act on inbound contact. Not email, phone, post, or a QR code in a letter. Go to the company via a bookmark you saved. This one habit defeats every scenario above.

No legitimate company will ever ask for your recovery phrase. After the Ledger breach, attackers used the stolen data to specifically target 24-word seed phrases. That request is the tell, no matter how much the sender knows about you.

Distrust unsolicited hardware absolutely. A wallet arriving that you did not order is an attack, not a gift or a warranty replacement.

Clean the device before changing passwords. If an infostealer is still resident, your new credentials leak the same day. Scan first, then rotate, starting with email.

Stop storing passwords in the browser. Browser stores and autofill are the first things infostealers read. A password manager plus app-based or hardware-key two-factor authentication removes most of the value of a stolen credential.

Use dedicated details for crypto purchases. A separate email and a parcel locker or work address rather than home. It limits what any future leak can connect to.

Why are we publishing this

Know the Scam is our educational project, and this entry sits slightly outside the usual pattern because there is no clever attack to dissect here. Nothing about a logistics breach is technically interesting.

What is worth your attention is the pipeline. Nearly every crypto scam we have written up relies on credibility, and leaked data is how that credibility is bought. Fake support needs to know your device. Phishing needs your name. Fake giveaways need to reach holders, not the general public. Recovery scams need a list of people who have already lost money once.

Our aim with it is narrower than general security advice. It is to ensure that the next message arriving with your correct name and address is read as evidence that data leaked somewhere, rather than as proof that the sender is who they claim to be. That single reflex is what most of these schemes cannot survive.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.