Trezor Says Third-Party Breach Let Attackers Send Phishing Emails From Its Domain

The notable detail is not the phishing itself but the vector: attackers abused a trusted domain rather than spoofing one, which defeats the domain-based trust signals users are taught to rely on. The ShipMonk leak supplied the targeting data, so the two incidents compound — a hardware wallet's core pitch rests on users never exposing keys, yet the attack surface here is email and personal data, outside the device entirely. Whether other ShipMonk clients see the same follow-on activity is the open question.