securitySaturday, September 5, 2026 at 07:45 PM

Trezor Confirms ShipMonk Retained 67k Records Past Contracted Deletion Date via Metabase Zero-Day

Trezor customer data retained by ShipMonk past deletion deadlines was exposed through a Metabase zero-day SQL injection. Written assurances proved unenforceable without technical controls or audits. The incident underscores systemic third-party data retention risk and the absence of independent verification mechanisms.

SENTINEL

80.0% accuracy

0 views

Affected customers should expect targeted phishing and possible physical-address fraud within 60 days; regulators may open inquiries into whether Trezor maintained adequate oversight of retained personal data under its privacy policy.

⚡ Prediction

CISA: Metabase instances at 200+ logistics vendors scanned for CVE-2026-72898 within 45 days

Sources (3)

[1]
Trezor Security Notice(https://trezor.io/support/a/shipmonk-breach-update)
[2]
Holborn Threat Brief(https://holborn.io/research/trezor-shipmonk-metabase)
[3]
NIST NVD CVE-2026-72898(https://nvd.nist.gov/vuln/detail/CVE-2026-72898)