Supply Chain Shock: How an Unpatched Metabase Server Turned Trezor’s Warehouse into a Goldmine for Hackers

In a stark reminder that your product’s security is only as strong as the operational tooling behind it, hardware wallet giant Trezor has disclosed a massive supply chain breach. The attack, which originated not from the wallets themselves but from a fulfillment partner’s exposed analytics server, has compromised the personal data of over 80,000 U.S. customers. This incident underscores a critical vulnerability in modern cybersecurity: the unglamorous, often forgotten business intelligence tools that sit on the public internet, waiting to be exploited.

On September 2, Trezor revealed that a breach at its third-party logistics partner, ShipMonk, was significantly more extensive than initially reported. What began as a contained incident ballooned into a full-blown data breach affecting an additional 67,000 U.S. customers. Combined with the initial disclosure, the total number of exposed individuals now stands at roughly 80,689. The compromised data includes names, email addresses, phone numbers, shipping addresses, and order numbers, spanning orders placed between November 2019 and August 2021. Crucially, Trezor has confirmed that the hardware devices themselves were not compromised; the attack vector was purely a supply chain vulnerability targeting the operational infrastructure of their vendor.

The root cause of this cybersecurity nightmare was a specific, unpatched vulnerability in a Metabase instance that ShipMonk ran on the public internet. The entry point was CVE-2026-72898, a critical flaw described as an unauthenticated SQL injection in Metabase’s password reset endpoint. This vulnerability carries a perfect CVSS score of 10.0, indicating the highest possible severity. The timeline of the exploit is a textbook case of the "window of exposure" that security researchers dread. Metabase published the advisory for this vulnerability on August 6. By August 11, the Cybersecurity and Infrastructure Security Agency (CISA) had already added it to its Known Exploited Vulnerabilities (KEV) catalog, confirming that it was being actively exploited in the wild, with documented ransomware use. ShipMonk, unfortunately, fell squarely into that window of vulnerability.

The mechanics of the attack are alarmingly straightforward, highlighting how a single unpatched vulnerability can lead to total system compromise. The /api/session/reset_password endpoint in Metabase allowed unauthenticated attackers to inject malicious SQL queries into the application’s database. This granted them immediate administrator access to the entire Metabase instance. With admin privileges, the attackers could change application configuration, steal stored credentials for connected databases, and, most damagingly, export sensitive data at will. Security firm Horizon3.ai estimated that roughly 4,309 of the 11,000 internet-exposed Metabase instances were likely vulnerable to this specific exploit. ShipMonk’s instance was one of them, making it a prime target for malicious actors.

What makes this breach particularly egregious is the contractual failure that allowed it to happen. Trezor had a contract with ShipMonk that explicitly required the fulfillment partner to delete customer data after a 90-day period. According to Trezor’s official disclosure, the company repeatedly requested and received written confirmation that this data deletion had occurred. It had not. The data remained on ShipMonk’s systems, persisting on an internet-facing business intelligence tool, long after it should have been purged. As Trezor stated in its official disclosure: “Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications. We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.” This gap between contractual expectation and technical reality is precisely where attackers operate.

This breach follows a pattern that security researchers have tracked across multiple infrastructure layers. When management tools or business intelligence platforms sit on the public internet without proper authentication or patching, they become pivot points for attackers, regardless of how secure the primary product is. We have seen this with PaperCut’s print management server, N-able’s MSP console, Microsoft’s self-service password reset, and Cisco’s management plane. In each case, the exposure was not at the product level but at the operational tooling level. Trezor’s incident extends that pattern directly into the crypto supply chain. The wallet was never the target; the warehouse’s analytics stack was. This is a critical lesson for any organization that relies on third-party vendors: your security posture is only as strong as the weakest link in your supply chain.

The blast radius of CVE-2026-72898 reached far beyond ShipMonk. Framework, Anaconda, and n8n—all Metabase Cloud tenants—reported unauthorized access to customer data during the pre-patch window. The fallout even extended to the dark web, where a ShinyHunters leak-site listing labeled “Metabase” appeared with approximately 7 gigabytes of related data, though the scope of that leak remains unconfirmed. Halborn, the enterprise blockchain security firm, attributed the Trezor breach to ShinyHunters, describing it as “a supply chain attack beginning with a zero-day vulnerability” where “the attackers were able to exploit several of its customers, stealing sensitive data and extorting the organization.” However, it is important to note that this attribution rests on pattern analysis and third-party reporting, not direct technical evidence. ShipMonk has not publicly acknowledged the incident, leaving many questions unanswered about the full scope of the compromise.

For the affected Trezor customers, the exposed data—phone numbers, shipping addresses, and order history—provides immediate material for targeted phishing attacks. This is a particularly dangerous threat vector for crypto hardware buyers, who are often perceived as holding significant digital assets. Trezor has already warned customers about precisely this risk, advising them to be vigilant against unsolicited communications that may attempt to trick them into revealing their recovery seeds or other sensitive information. The combination of a physical address and a known purchase of a hardware wallet makes these individuals high-value targets for sophisticated social engineering campaigns.

For security practitioners, this incident raises a fundamental structural question: can vendor risk management programs enforce the technical controls that contractual clauses clearly cannot? Written assurances about data deletion did not prevent the data from persisting on an internet-facing BI tool with an unauthenticated critical vulnerability. The answer lies in moving beyond paper-based compliance and toward continuous technical verification. Organizations must demand evidence of patching cadence, conduct regular security assessments of vendor infrastructure, and, where possible, require vendors to use managed services that handle security updates automatically. The Trezor breach is a powerful reminder that in the world of cybersecurity, trust is not a substitute for verification.

In conclusion, the Trezor supply chain breach is a sobering case study in the fragility of modern digital ecosystems. It demonstrates that a sophisticated hacking operation doesn’t need to attack the most secure element of a system; it simply needs to find the most vulnerable one. The unpatched Metabase server at ShipMonk was that weak point, and its exploitation has exposed tens of thousands of crypto customers to potential fraud and phishing. As we move forward, the lesson is clear: robust cybersecurity requires a holistic view that encompasses every piece of operational tooling, every third-party partner, and every internet-exposed service. The gap between what we promise in contracts and what we enforce in practice is where attackers will continue to thrive.