← ShipMonkreviewed 2026-10-21 · 20 claims checked
Fact-check findings
What an automated fact-checker found when it re-read ShipMonk against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #12[unverifiable][awaiting moderator]in section: Elevated Physical Risk to Crypto Hardware Wallet Owners
“The Trezor 2026 breach is the first incident in the company's 13-year history to expose customer phone numbers and residential addresses at scale.”
reviewerThe Trezor 2026 breach is the first incident in the company's 13-year history to expose customer phone numbers and residential addresses at scale.The '13-year' company age checks out, but no source was found that affirmatively states this is the first such incident in Trezor's history; this appears to be an inference rather than a sourced fact. - #18[unverifiable][awaiting moderator]in the timeline
“ShinyHunters lists Metabase on its dark-web leak site, claiming responsibility for the attack on the analytics platform.”
reviewerShinyHunters lists Metabase on its dark-web leak site on August 13, 2026.The event itself (ShinyHunters listing Metabase) is well supported, but the specific August 13 date could not be independently confirmed and conflicts with at least one secondary source citing August 11.
stale
4 claimsThe claim was accurate when written but events since have overtaken it.
- #7[stale][awaiting moderator]in section: Scope of Exposed Customer Data
“ShipMonk's breach exposed order data for 13,689 confirmed Trezor customers who received shipments between May 10 and August 8, 2026, across seven countries: the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.”
reviewerShipMonk's breach exposed order data for 13,689 confirmed Trezor customers who received shipments between May 10 and August 8, 2026, across seven listed countries.The 13,689 figure and country list were accurate as of the page's initial Aug 2026 reporting window but are now superseded: Trezor disclosed in September 2026 that the breach was roughly six times larger than first reported.Proposed correction (not yet applied)ShipMonk's breach initially exposed order data for 13,689 confirmed Trezor customers who received shipments between May 10 and August 8, 2026, across seven countries: the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. In a September 2026 update, Trezor disclosed that approximately 67,000 additional U.S. customers who had placed orders between November 2019 and August 2021 were also affected, bringing the total to approximately 80,700. - #15[stale][awaiting moderator]in section: Mitigating Factors
“This policy bounded the accessible window to orders between May 10 and August 8, 2026, and meant that older customer records were no longer held in ShipMonk's systems at the time of the breach.”
reviewerTrezor's 90-day data retention/deletion policy bounded the accessible breach window and meant older customer records were no longer held in ShipMonk's systems at the time of the breach.This was the best information available at the time the page was written, but is now directly contradicted by Trezor's own September 2026 disclosure that ShipMonk had not followed the deletion policy, retaining records for years rather than 90 days.Proposed correction (not yet applied)Trezor's 90-day retention policy was intended to bound the accessible window to orders between May 10 and August 8, 2026, but a September 2026 Trezor disclosure revealed that ShipMonk had not actually deleted older order data as contractually required and previously confirmed in writing, exposing an additional approximately 67,000 U.S. customers whose orders dated from November 2019 to August 2021. - #16[stale][awaiting moderator]in section: Regulatory and Legal Status
“As of August 14, 2026, no regulatory enforcement actions, fines, class-action lawsuits, or criminal charges related to the ShipMonk breach have been publicly reported.”
reviewerAs of August 14, 2026, no regulatory enforcement actions, fines, class-action lawsuits, or criminal charges related to the ShipMonk breach have been publicly reported.The 'no regulatory/legal action reported' framing is dated; by September 2026 Trezor was reportedly weighing legal action against ShipMonk, a materially relevant development the page omits.Proposed correction (not yet applied)As of August 14, 2026, no regulatory enforcement actions, fines, class-action lawsuits, or criminal charges related to the ShipMonk breach had been publicly reported; following the September 2026 disclosure that ShipMonk had not deleted customer data as contractually required, Trezor said it was considering legal action against ShipMonk, though no fine, lawsuit, or criminal charge had been filed as of this report. - #20[stale][awaiting moderator]in the summary
“In August 2026, ShipMonk disclosed that an unauthorized party had exploited a critical SQL injection zero-day vulnerability in Metabase, a third-party analytics platform deployed by ShipMonk, to access Trezor customer order data for at least 13,689 individuals.”
reviewerIn August 2026, ShipMonk disclosed that an unauthorized party had exploited a critical SQL injection zero-day vulnerability in Metabase to access Trezor customer order data for at least 13,689 individuals.The summary's headline figure is now substantially out of date given Trezor's September 2026 disclosure of a much larger breach scope.Proposed correction (not yet applied)In August 2026, ShipMonk disclosed that an unauthorized party had exploited a critical SQL injection zero-day vulnerability in Metabase, a third-party analytics platform deployed by ShipMonk, to access Trezor customer order data; Trezor initially reported at least 13,689 affected individuals, a figure it revised upward to approximately 80,700 in a September 2026 update.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Company Overview
“ShipMonk company profile — CBInsights”
reviewerCBInsights is cited as supporting ShipMonk's 2014 founding date, but CBInsights' own profile lists a 2018 founding year.The cited CBInsights source internally conflicts with the founding year stated on the page; the 2014 date is still correct per independent sources, but CBInsights should not be cited for it. - #3[partially supported][awaiting moderator]in section: Company Overview
“employs more than 1,000 staff”
reviewerShipMonk employs more than 1,000 staff.Technically not false, but materially understates current headcount reported elsewhere (2,000-2,500+). - #11[partially supported][awaiting moderator]in section: Elevated Physical Risk to Crypto Hardware Wallet Owners
“the Ledger breach of 2020, which affected approximately 270,000 customers — were subsequently linked to phishing campaigns, counterfeit device shipments, and documented extortion demands”
reviewerThe Ledger breach of 2020 affected approximately 270,000 customers and was linked to phishing campaigns, counterfeit device shipments, and extortion demands.Reported figures for the Ledger breach range from ~272,000 to Ledger's own official total of 292,000 customers with full contact data exposed, plus ~1 million email-only exposures; 'approximately 270,000' is in the right range but is at the low end and understates Ledger's own disclosed total.
confirmed
11 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Company Overview
“ShipMonk was founded in 2014 and is headquartered in Fort Lauderdale, Florida.”
reviewerShipMonk was founded in 2014 and is headquartered in Fort Lauderdale, Florida.2014/Fort Lauderdale is corroborated by independent sources (Entrepreneur, job listings), so the claim itself holds, though one of the two cited sources disagrees (see next finding). - #4[confirmed][no action needed]in section: Company Overview
“ShipMonk operates more than 12 fulfillment centers across the United States, Canada, Mexico, and Europe”
reviewerShipMonk operates more than 12 fulfillment centers across the US, Canada, Mexico, and Europe.Facility count and geographic footprint match independent listings. - #5[confirmed][no action needed]in section: Breach Overview: Metabase SQL Injection Zero-Day
“The vulnerability, later assigned CVE-2026-72898 with a CVSS score of 10.0, resides in the /api/session/reset_password endpoint and allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, gaining administrator-level access without any credentials.”
reviewerA critical SQL injection zero-day in Metabase (CVE-2026-72898, CVSS 10.0) in the /api/session/reset_password endpoint allowed unauthenticated admin-level access, affecting versions v1.58.0 through v1.63.3, publicly disclosed and patched August 6, 2026.Minor ambiguity: some sources give the exact vulnerable path as /reset_password (CVE.org) vs. /api/session/reset_password (vendor workaround advisory); both describe the same flaw and the page's wording is reasonable. - #6[confirmed][no action needed]in section: Breach Overview: Metabase SQL Injection Zero-Day
“The extortion group ShinyHunters subsequently claimed responsibility for attacking Metabase and listed Metabase on its dark-web leak site. ShinyHunters is a financially motivated criminal extortion group operating a pay-or-leak model that has been active since 2019; the group's claim has not been independently verified by law enforcement as of the date of this report.”
reviewerShinyHunters claimed responsibility for the Metabase attack and listed Metabase on its dark-web leak site; the group is a financially motivated extortion group active since 2019 operating a pay-or-leak model, and the claim is unverified by law enforcement.Core claim holds; 'active since 2019' is supported by some threat-intel profiles (MITRE, Huntress) though others date the group's first public appearance to 2020 — a minor, immaterial variance. The exact leak-site listing date (page's timeline places it Aug 13; one secondary source gives Aug 11) could not be pinned down with a tier-1 source. - #8[confirmed][no action needed]in section: Scope of Exposed Customer Data
“Of those, 11,742 customers had full records exposed — including full name, email address, phone number, and complete shipping (home) address. A further 1,947 customers had partial records exposed — name, city, and email address only.”
reviewerOf the affected customers, 11,742 had full records exposed (name, email, phone, address) and 1,947 had partial records exposed (name, city, email).Figures accurately reflect the original (Aug 2026) disclosure; see separate finding on the Sept 2026 expansion. - #9[confirmed][no action needed]in section: Scope of Exposed Customer Data
“Trezor confirmed that Amazon-fulfilled orders were not affected.”
reviewerTrezor confirmed that Amazon-fulfilled orders were not affected.Directly confirmed by cited CoinDesk article. - #10[confirmed][no action needed]in section: Scope of Exposed Customer Data
“Trezor stated that it is evaluating whether to continue its partnership with ShipMonk.”
reviewerTrezor stated that it is evaluating whether to continue its partnership with ShipMonk.Confirmed by the cited Protos article. Note: by September 2026, coverage indicates Trezor was considering legal action against ShipMonk rather than merely 'evaluating the partnership' — see Regulatory and Legal Status finding. - #13[confirmed][no action needed]in section: Broader Metabase Supply Chain Campaign
“Framework, a modular laptop manufacturer, confirmed that customer names, email addresses, phone numbers, postal addresses, and login IP addresses were accessed via the same vulnerability. Tally, a form-building platform, reported compromised email addresses and password hashes. n8n, a workflow automation platform, confirmed unauthorized access to 136 customer records including bcrypt-hashed passwords for five cloud accounts. Kilo Code confirmed exposure of Slack integration tokens, which were invalidated immediately.”
reviewerFramework, Tally, n8n, and Kilo Code were also compromised via the same Metabase zero-day, with specific data exposed for each (Framework: names/emails/phones/addresses/IPs; Tally: emails/password hashes; n8n: 136 records incl. 5 bcrypt-hashed cloud account passwords; Kilo Code: Slack tokens, invalidated immediately).All per-company details check out against primary/credible sources, though the specific n8n figures come from n8n's own blog rather than the three sources cited in this section — a citation gap, not a factual error. - #14[confirmed][no action needed]in section: Broader Metabase Supply Chain Campaign
“Metabase is used by more than 100,000 organizations across more than 150 countries as a business intelligence and analytics platform.”
reviewerMetabase is used by more than 100,000 organizations across more than 150 countries.Directly confirmed by the cited source. - #17[confirmed][no action needed]in the timeline
“ShipMonk notifies Trezor of the unauthorized access to customer order data.”
reviewerShipMonk notified Trezor of the unauthorized access to customer order data on August 10, 2026.Date and event match independent reporting. - #19[confirmed][no action needed]in the timeline
“ShipMonk has not issued a public statement acknowledging the breach. No regulatory actions, lawsuits, or criminal charges publicly reported as of this date.”
reviewerShipMonk has not issued a public statement acknowledging the breach, and no regulatory actions, lawsuits, or criminal charges are publicly reported as of August 14, 2026.Accurate as a snapshot of August 14, 2026; see separate stale finding on the Regulatory and Legal Status section for what has changed since.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.