In August 2026, hardware wallet maker Trezor disclosed a data exposure at one of its shipping vendors. In a post on its own blog, Trezor named the vendor directly: ShipMonk, an ecommerce fulfillment provider.
The numbers, per Trezor's disclosure: 13,689 customers affected, with 11,742 records fully exposed (name, email, phone, and shipping address) and 1,947 partially exposed (name, city, and email). The fully exposed orders shipped between May 10 and August 8, 2026, to customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal; Trezor says the timeframe for the partially exposed records is still being verified and may include older orders. No Trezor system, product, or service was affected; the exposure was contained to the fulfillment side of the order chain. Neither company has published a root cause, and there's no confirmed reporting on how the exposure happened.
If you sell physical products online, the containment boundary here matters: the exposure happened one layer downstream, at the vendor holding a working copy of Trezor's customer list to print labels and ship orders, not inside Trezor's own systems. Most ecommerce brands hand a fulfillment partner some version of that same list: names, addresses, emails, and order history. How that partner retains, restricts, and discloses that data is mostly invisible until an incident like this one makes it visible.
Four questions worth asking before you sign
This incident is a live example of what to check before you hand a vendor your customer list.
- Data retention limits. How long does the vendor keep customer PII after an order ships, and is that written into policy rather than left open-ended? A vendor holding years of order history carries a bigger blast radius than one that ages data out on a schedule. Trezor says a negotiated 90-day deletion/anonymization policy limited its exposure: for the confirmed May 10–Aug 8, 2026 window, orders outside that range had already been deleted or anonymized; Trezor says the timeframe for the smaller set of partially exposed records is still being verified and may include older orders.
- PII access controls. Who inside the vendor's operation can pull up a full, unredacted customer record, and is that access role-based and logged, or can most of the floor see it? Ask for the access policy in writing, not just a verbal answer.
- Breach-notification SLAs. If something goes wrong, how fast are you contractually entitled to hear about it, and what's the process once that clock starts? Ask to see the notification clause in the contract itself, not just a verbal estimate.
- Subprocessor agreements. Which other companies touch your data downstream of the 3PL itself: carriers, warehouse management software, label printers, returns platforms? Ask the vendor to name its subprocessors by name and confirm each one is under contract, not just assumed.
No fulfillment partner can promise zero risk
No 3PL, including Simpl, can guarantee it will never be breached. What you can evaluate before you sign is whether a partner treats retention, access, and disclosure as deliberate policy, not something nobody's written down yet. For the rest of the evaluation: pricing, integrations, SLAs, and the other questions that separate a partner from a vendor, see How to Choose a 3PL in 2026.