ShipMonk Named 2026 Inc. Power Partner Award Winner. Recognition highlights ShipMonk's technology-driven approach to helping ecommerce brands scale, adapt, and navigate operational complexity. FORT LAUDERDALE, Fla., October 20, 2026 - ShipMonk, a technology-driven fulfillment partner for mid-ShipMonk Named 2026 Inc. Power Partner Award Winner Recognition highlights ShipMonk's technology-driven approach to helping ecommerce brands scale, adapt, and navigate operational complexity. FORT LAUDERDALE, Fla., October 20, 2026 - ShipMonk, a technology-driven fulfillment partner for mid-market and enterprise ecommerce brands, has been named a winner of the 2026 Inc. Power Partner Awards. The annual awards recognize leading B2B companies across technology, infrastructure, financial services, marketing, and other sectors that have demonstrated a track record of helping businesses overcome challenges and navigate their next stage of growth. "Fulfillment should do more than make operations more efficient. It should create new possibilities for growth," said Kevin Xu, ShipMonk's Chief Strategy Officer. "That's why we stay merchant-first in everything we build. ShipMonk is the real-world engine behind ecommerce brands, connecting software, agentic commerce, and physical operations to give merchants more ways to grow, adapt, and compete. Being named an Inc. Power Partner for the second year in a row tells us our merchants feel that commitment from us." As commerce evolves, fulfillment must evolve with it. ShipMonk helps ecommerce brands keep pace with changing customer expectations, new ways of selling, and an increasingly complex path from purchase to delivery. "Business owners have no shortage of tools at their disposal, and B2B companies need to make clear why their products and services are worth the investment," says Bonny Ghosh, editorial director at Inc. "The companies on this year's Power Partners list have done just that. They don't just have customers - they have superfans and evangelists. Across industries like marketing, financial services, and technology, they've proved their dedication to helping fellow business owners grow and succeed." About ShipMonk. About ShipMonk: Founded in 2014, ShipMonk is a global fulfillment provider that helps high-growth ecommerce and enterprise brands scale with confidence. ShipMonk combines proprietary technology with a network of owned and operated fulfillment centers around the world, giving brands real-time visibility, operational control, and the flexibility to grow across channels and regions. Built on a merchant-first philosophy, ShipMonk supports complex fulfillment needs across categories including apparel, wellness, and consumer goods - handling everything from inventory management and order fulfillment to returns and value-added services. With a focus on accuracy, reliability, and long-term partnership, ShipMonk helps brands stress less and grow more. For more information, visit shipmonk.com. About Inc. Inc. is the leading media brand and playbook for the entrepreneurs and business leaders shaping its future. Through its journalism, Inc. aims to inform, educate, and elevate the profile of its community: the risk-takers, the innovators, and the ultra-driven go-getters who are creating the future of business. Inc. is published by Mansueto Ventures, along with fellow leading business publication Fast Company. For more information, visit www.inc.com. Level up your fulfillment strategy.

Trezor Email Provider breached; 81,000 hit by prior leak. Trezor says hackers breached its email provider and sent fake STM32 security alerts, weeks after a ShipMonk leak exposed data on 81,000 customers total. The Payney Desk The 30-second version Payney AI * 01Trezor says attackers breached a third-party email provider and sent phishing emails from its domain. * 02The fake alert claims a 'STM32 Entropy Vulnerability' and pushes users toward handing over recovery phrases. * 03A separate August breach at shipper ShipMonk now covers 81,000 customers, up from about 13,689. * 04It matters because leaked names, addresses and phones make future crypto phishing far more convincing. 81,000 Trezor customers have now had order data exposed in the August breach at logistics provider ShipMonk, after the company revised its first estimate of roughly 13,689 upward in early September. On 9 September 2026, Trezor said attackers had separately breached a third-party email provider and used it to push out a fake warning titled 'Critical Security Alert: STM32 Entropy Vulnerability' - a message engineered to get recipients to type in the recovery phrase that controls their coins. What Trezor said about the email breach. According to BeInCrypto, Trezor said attackers breached its third-party email provider and sent customers a phishing message disguised as a critical chip security alert, that the company has taken down the domain used in the campaign, and that it is investigating how the attackers were able to send from its legitimate domain. Trezor said wallets, private keys and recovery backups stored on devices were not exposed. Trezor has not publicly named the email provider. Two terms in the lure are worth decoding, because the fake alert borrows real vocabulary. STM32 is the family of microcontroller chips used inside Trezor devices. Entropy is the randomness a wallet uses when it generates a recovery phrase; weak entropy would, in theory, make a backup guessable. Pairing a genuine chip name with a genuine cryptographic concept is what makes the email read as technical rather than fraudulent. One correction to how this story is being framed elsewhere: a Trezor is a self-custody device, not a custodial service. The company never holds customer coins, which is precisely why attackers go after the recovery phrase instead - it is the only thing that can move the funds. The same day, Swiss hardware wallet maker BitBox posted on X that a phishing mail had gone to its newsletter subscribers and that its preliminary review found it very likely that its newsletter provider was compromised. BitBox added that multiple other Bitcoin companies were targeted and appeared to share the same newsletter provider, that it warned subscribers and reported the phishing domains, and that most links had already been taken down. That is a preliminary assessment from one company, not a confirmed shared root cause across vendors. How the ShipMonk count went from 14,000 to 81,000. The email incident lands on top of an unresolved data leak. Trezor's own blog post says ShipMonk, one of its shipping providers, suffered a breach exposing customer order data including full names, physical addresses, phone numbers and email addresses. Security firm Halborn's write-up dates the notification to 10 August 2026 and splits the initial scope into 11,742 customers with names, phone numbers, emails and shipping addresses exposed, plus 1,947 with partial exposure. Halborn attributes the intrusion to exploitation of a public-facing Metabase application via SQL injection, escalated to administrator access, followed by extortion emails to ShipMonk from the group ShinyHunters. Trezor's blog then records an update dated 4 September 2026: on 2 September it was told the breach was larger than stated and also contained order data from a prior cooperation with ShipMonk between November 2019 and August 2021, despite Trezor having repeatedly requested and received written assurance that the data was deleted. BleepingComputer reports that this added roughly 67,000 U.S. customers, bringing the total to 81,000. The two headline numbers are the same incident measured at different dates, not two separate breaches: 11,742 plus 1,947 is 13,689 ("nearly 14,000"), and adding the 67,000 older U.S. records gives 80,689, which BleepingComputer rounds to 81,000. | Metric | Value | Source | | Total customers affected by ShipMonk breach (revised) | 81,000 | BleepingComputer | | Initial disclosure: full exposure / partial exposure | 11,742 / 1,947 | Halborn | | Additional U.S. customers added 4 Sept 2026 (orders Nov 2019-Aug 2021) | ~67,000 | Trezor blog; BleepingComputer | | Order window in first disclosure | 10 May - 8 Aug 2026 | BleepingComputer | | Trezor eShop stated data-retention period | 90 days | The Hacker News, quoting Trezor | | Users warned after 2024 Trezor support-portal breach | 66,000 | BeInCrypto | What the figures actually establish for a Trezor owner. Nothing in these disclosures indicates that the hardware was broken. Every verified loss vector here runs through data held by suppliers, not through the device. That distinction matters for what you should do: firmware and PINs are not the exposure; your contact details are. The 81,000 figure is a count of exposed customer records, not a count of phishing emails sent, victims, or coins stolen. Trezor has not disclosed how many recipients got the 9 September email, and no confirmed thefts from that campaign had been reported at the time of writing. It is also an assumption, not a fact, that the ShipMonk list and the email list are the same people - they were held by different vendors. The valid comparison is with Trezor's earlier contact-data incidents. BeInCrypto notes Trezor warned 66,000 users after a 2024 support-portal breach, and describes the September email incident as the company's third vendor failure in four weeks; it also reports that rival SafePal leaked nearly 40,000 records in the prior month. BeInCrypto further reports that customers have since received scam calls and printed letters, which is the practical consequence of a leak that included phone numbers and home addresses rather than just email. The Hacker News quotes Trezor saying it deletes or anonymises eShop purchase data after 90 days, chosen as the shortest window covering delivery, returns and refunds. Read against the 2019-2021 records that surfaced in the leaked dataset, that policy shows the limit of a retention rule: it governs what the merchant keeps, not what a third-party processor actually deleted. What is still unknown. * The provider. Neither Trezor nor BitBox named the compromised email vendor in the statements found. * The scale of the phishing wave. No recipient count, click-through count or loss figure has been published. * Whether the incidents are linked. BitBox's shared-provider theory is explicitly preliminary; Trezor says it is still investigating how attackers reached its legitimate domain. * Any deadline. No dated regulatory filing, notification schedule or investigation report was published alongside these statements, so there is no verified upcoming catalyst to watch. The single rule that survives all of this: a recovery phrase entered into any website, app or form other than the device itself is a transfer of ownership, and it cannot be reversed. Sources used during research. Check their dates and original context before relying on a figure. How Payney report. Crypto Trezor Email Provider Breach Phishing Trezor Stm32 Entropy Vulnerability Email Trezor Shipmonk Data Breach 81,000 Customers Bitbox Newsletter Provider Phishing September 2026 Frequently asked Is there a real STM32 entropy vulnerability in Trezor wallets? No. Trezor said the email titled 'Critical Security Alert: STM32 Entropy Vulnerability' is a phishing attempt sent via a breached third-party email provider, and that wallets, private keys and recovery backups on devices were not exposed. Was my data in the Trezor ShipMonk breach? The first disclosure covered about 13,689 customers with orders received between 10 May and 8 August 2026 in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal; the 4 September update added roughly 67,000 US customers with orders from November 2019 to August 2021. Do I need to move my crypto if I received the phishing email? Only if you entered your recovery phrase or passcode somewhere after clicking. Trezor says the devices themselves were not compromised, so simply receiving or opening the email does not put funds at risk.

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted TheHackerNews 05 Sep 2026