While Trezor didn’t share how the shipping provider’s systems were breached, in breach notification emails sent to affected customers and reviewed by BleepingComputer, ShipMonk told customers that the attackers exploited a vulnerability in the third-party analytics platform Metabase.

”On August 6, 2026, Metabase informed us that an unauthorized party exploited a vulnerability in Metabase’s software to access data related
to your account and your customers," ShipMonk said.

“Based on the vendor’s representations, we understand that the vendor has since patched the vulnerability and invalidated all active sessions. We also
initiated a thorough and detailed technical investigation with the assistance of external information technology experts.”

As BleepingComputer previously reported, Metabase revealed that the threat actors exploited a critical SQL injection zero-day vulnerability to breach customer instances and carry out data theft attacks after gaining administrator access to the compromised instance.

God forbid you run your own damned database