Executive Summary
A critical zero-day vulnerability in the open-source business intelligence platform Metabase (tracked as CVE-2026-72898 with a maximum CVSS score of 10.0) has triggered a major third-party supply chain breach impacting hardware cryptocurrency wallet manufacturer Trezor. The breach occurred when threat actors—subsequently identified in extortion attempts as the notorious ShinyHunters syndicate—exploited an unauthenticated SQL injection vulnerability in the /reset_password endpoint of a publicly accessible Metabase server operated by third-party logistics and shipping provider ShipMonk. The compromise resulted in the unauthorized exfiltration of sensitive shipping and contact records for nearly 14,000 Trezor customers across the globe.
Incident Overview & Threat Attribution
On August 10, 2026, Trezor was officially alerted by its primary logistics contractor, ShipMonk, that customer shipping directories had been compromised. A total of 11,742 customers had full shipping details leaked—including full legal names, phone numbers, delivery addresses, and email addresses—while an additional 1,947 customers suffered partial records exposure. Importantly, cryptocurrency assets, recovery seeds, PINs, and device firmware remained completely uncompromised, as Trezor hardware wallets do not transmit cryptographic credentials to logistics providers. Furthermore, customers who ordered hardware units via Amazon were unaffected, as Amazon uses an independent fulfillment pipeline.
Shortly after the data exfiltration, ShipMonk received extortion demands from threat actors affiliated with ShinyHunters, threatening public leak repository publication if ransom demands were not met.
Deep-Dive Technical Analysis
Vulnerability Mechanics (CVE-2026-72898)
The root cause of the intrusion lies in Metabase versions prior to the August 2026 emergency update. The platform's password reset routine failed to enforce strict schema validation on incoming JSON payloads transmitted to the /api/user/reset_password endpoint:
* Unsanitized Payload Deserialization: The endpoint accepted arbitrary JSON fields alongside standard email identification parameters without schema restriction or parameter encapsulation.
* Dynamic Query Concatenation: When parsing user lookup tokens, the internal query builder dynamically concatenated input values into backend PostgreSQL and MySQL queries rather than executing parameterized statements via pre-compiled ORM bindings.
* Stacked Query Execution & Privilege Escalation: Because the database connection operated with elevated database superuser privileges, the unauthenticated SQL injection allowed the threat actor to execute stacked SQL commands, dump entire schema catalogs, extract active admin session tokens, and forge administrative credentials to gain complete administrative takeover of the Metabase analytics instance.
l
-- Conceptual representation of the vulnerable input reflection in reset_password endpoint
POST /api/user/reset_password HTTP/1.1
Host: analytics.shipmonk.internal
Content-Type: application/json
{
"token": "valid_or_dummy_token",
"email": "admin@shipmonk.internal' UNION SELECT 1, null, password_hash, session_token FROM core_user WHERE is_superuser=true --",
"new_password": "AttackerControlledPassword123!"
}
Initial Access to Lateral Exfiltration Pipeline
1. Perimeter Scanning: Attackers identified a public-facing Metabase instance deployed without VPN or IP-allowlist restrictions.
2. Zero-Day Exploitation: Utilizing CVE-2026-72898 on August 3, 2026 (a week prior to public disclosure and patch availability), the attacker executed the SQL injection payload.
3. Database Harvesting: Using administrative dashboard privileges, the attacker ran automated queries against connected fulfillment databases, exporting historical e-commerce shipping logs containing Trezor order data.
4. Data Staging & Exfiltration: Extracted records were zipped and exfiltrated over encrypted HTTPS channels to external command-and-control (C2) servers.
Industry Impact & Risk Assessment
* Targeted Physical & Phishing Attacks: Hardware wallet users face heightened risks of sophisticated spear-phishing (e.g., fake SMS/email firmware update alerts) and potential physical extortion ("$5 wrench attacks") due to exposed home addresses.
* Third-Party Logistics as an Attack Surface: This breach underscores how secure hardware products can be undermined by vulnerabilities in third-party supply chain partners.
* Database Privilege Over-Scoping: E-commerce analytics tools frequently retain unnecessary broad access to live transactional customer databases.
Security Recommendations & Mitigations
For Organizations & Logistics Providers:
1. Immediate Patching: Upgrade all Metabase deployments immediately to version 0.50.24 / 1.50.24 or later.
2. Perimeter Isolation: Never expose internal analytics, BI dashboards, or admin portals directly to the public internet. Enforce strict Zero-Trust Network Access (ZTNA) or VPN authentication with mandatory MFA.
3. Principle of Least Privilege for Analytics: Restrict BI database service accounts to read-only views containing anonymized/tokenized data rather than raw PII.
4. Automated WAF Rules: Deploy Web Application Firewall rules to detect SQL injection syntax and stacked queries targeting REST endpoints.
For Impacted Trezor & E-Commerce Customers:
1. Heightened Phishing Vigilance: Treat all unsolicited communications requesting wallet recovery seed phrases, PINs, or urgent firmware downloads as malicious. Trezor will never ask for recovery seeds.
2. Contact Channel Hardening: Monitor associated email and phone numbers for SIM-swapping or targeted credential-phishing attempts.
3. Address Verification: Consider using commercial PO boxes or secure pickup lockers for future privacy-sensitive hardware shipments.