An SQL injection exploit against a Metabase instance at third-party logistics provider ShipMonk exposed names, emails, phone numbers, and physical delivery addresses for 13,689 Trezor customers. For hardware wallet buyers, a leaked home address tied to confirmed crypto ownership is arguably worse than a leaked email, since it creates a targeting list for physical attacks. It lands the same week BTCPay Server patched a flaw that let attackers exfiltrate Lightning credential files and sweep merchant funds.