Trezor Shipping Partner Kept Customer Data It Certified Deleted, Exposing 67,000 More

This incident shifts the spotlight from Trezor's own security posture to the integrity of its supply chain, underscoring that hardware wallet makers can only be as secure as their logistics vendors' data-handling practices. The scale—tens of thousands of records from years-old orders—matters because it suggests a systemic gap in third-party oversight, not just a one-off breach. For affected customers, the practical risk is social engineering or phishing tied to proof of past purchases, since crypto holdings may be inferred from order history. The key question is whether such certification failures will push the industry toward stricter contractual enforcement and independent audits of data destruction, or if this remains a recurring blind spot.