The personal details of nearly 14,000 crypto holders have been exposed in a data breach affecting Trezor, a hardware wallet provider. The company said a breach at its shipping provider exposed names, addresses, phone numbers and emails of 11,742 buyers, while another 1,947 customers had names, cities and emails hacked. Affected users are in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.

Trezor sells “cold” wallets – USB-like devices storing private keys offline. They are meant to be the most secure way to hold crypto keys. But their security has come under question. Two weeks earlier, more than $100mn was stolen from holders of Coldcard wallets due to a bug that made private keys insecure.

Crypto holders increasingly face physical attacks. In a high-profile case, the co-founder of rival Ledger was kidnapped in France. Chainalysis noted that kidnappings account for over half of 46 violent attacks on crypto investors this year. Trezor apologized and said affected customers may see more phishing attempts.

The company is working on an anonymous delivery option, to be available across the EU by September. It said it is not aware of any confirmed scam or hack resulting from this exposure so far.