You Didn't Get Hacked. Your Shipper Did.

A company sells you a small little box.

Their entire job and their offering of that box is to not trust anybody.

Don't trust the exchange.

Don't trust the app.

Don't trust the cloud.

Hold your own keys.

Last month, about 80,000 of their customers got their names, their phone numbers, their home addresses stolen.

Here's the kicker.

The company was never hacked.

What's good, Internet?

This is your boy Q, a.k.a. your IT guy's IT guy, and this is The Blast Radius.

All right, The Blast.

One story that actually happened and the part everybody's coverage skipped.

The company is Trezor.

Now, if you're not into crypto, they make these hardware wallets, little physical

devices that hold your keys to cryptocurrency so that it stays off the

Internet.

Their whole pitch, the whole entire reason a product exists is

don't leave your money where somebody else holding can can find

it.

Trust nobody. Be your own bank. So here's what's happened.

August 10th, a company called ShipMonk tells Trezor, hey, we got breached.

Now, ShipMonk isn't a crypto company. They do fulfillment.

they're the ones in the warehouse they have the people who put the little thing in the box slap

a label on it and they hand it

to the carrier August 13th Trezor discloses 13,689

customers

were affected now 13,000 is a bad week regardless

but it's a normal bad week you send emails

you

eat the headlines and you move on except

september 2nd ShipMonk comes back and says about

that

there's actually more turns out that the stolen files also had order records from an earlier

stretch of the relationships orders that came from november 2019 through august 2021

September 5th Trezor discloses again hey 67,000 more U. S.

customers so now let's do the math

13,689 plus 67,000 you're about roughly 87,000

people that got their names and information

addresses phone numbers shipping address order number now let's just sit with the shipping

address for just a second these are people who bought a hardware wallet the data set is

functionally a list of names home addresses of people who are publicly known to hold cryptocurrency

and how much hardware they bought to hold in it that's not a spam list that's a shopping list

Let's be real. There's a reason security world would call this one out for particular customers base.

A home address isn't just a leak or inconvenience. It's physical safety problem.

Here's where it gets good. And the part that nobody actually wants to remember or talk about.

The way in

was through a

CVE-2026-72898.

That is an SQL injection.

want y'all to actually remember.

The way in was through a critical vulnerability, or what

some of us know in the field as a CVE,

2026-72898.

That's like the individual markings or identification of a particular vulnerability that is found in software or different tooling.

That's an SQL injection vulnerability in a piece of software called Metabase.

The severity score of this was a 10.

You can't get higher than that. There's no 11. Now, Metabase, what is that? It's a business

intelligent tool. It's a dashboard. It's the thing that somebody on the ops team spun up so they

could look at the charts, the orders this week, shipping times by the region, pretty little graphs

for the Monday meeting for the CEO. Nobody in the building thinks of this dashboard as a security

reporting product. It's the reporting tool. It's the thing that's plugged into a database so it

can draw the charts and we can see how our market is going or whether we're selling or not selling

but here's the problem a reporting tool has to be able to read everything or it can't really

report on anything so the attackers didn't break into Trezor they didn't break into the Trezor

wallets and Trezor was very clear about that the breach does not affect the security of the hardware

wallets nobody's coins removed the crypto part of

this story is fine they broke into the

warehouse's

chart tool same week different

company a company called Mathspace

an online math learning platform

that has nothing to do with crypto nothing to do with any of this they were breached by their

Meta-based reporting system. Over a million students, staff, and parents. Same software,

completely unrelated victims. And that's what a real blast radius looks like. It doesn't travel

along your org charts.

It travels along your software bill of materials.

Trezor had a data

retention rule written into their contract. 90 days. That's genuinely a good practice.

A lot of companies 10 times their size don't even have anything remotely close to that.

And Trezor says, and they, quote, repeatedly requested and

received written assurance confirming the deletion of their data.

Written assurance repeatedly.

And the 2019 through 2021 orders were still

sitting in their 2026 waiting to get stolen.

this is the episode right here somebody sent the email say yeah we deleted it and everybody

filed that email and they felt good and it wasn't true maybe not even a lie maybe somebody truly

believed that the job ran but maybe it was on another system on the backup maybe the person

who deleted it left the company in his state archive it doesn't matter the paperwork said

gone.

The database said present.

Same window, completely separate incident.

Trezor's email provider, a company called Brevo got breached and the attackers used that

access to fish Trezor's customers.

347,000 emails went out.

2,500 people clicked.

so let's count in roughly one month this company got hit through their shipping vendor

and through their email two vendors two different companies and two different failures

Trezor's own systems were never touched either time

go look at the coverage most of it

reads

Trezor data breach some of it gets cute and implies that maybe the crypto people got their

wallets drain both wrong. Trezor did not get breached, not once, not twice. Trezor's security

did not fail. Their vendor's security failed and Trezor's customers paid for it. And honestly,

Trezor handled about as best as you can. As soon as they found out, they disclosed the information.

And again, when it got worse, they disclosed it. They emailed every new person they had.

They are not the villain of the story.

The real headline is this company whose entire product, trust nobody, got burned

twice by trusting somebody, not because they were careless, but because that's the

deal.

You cannot run a business without vendors and you cannot see inside your vendors.

And if it can can happen to a company that says paranoia for a living, we need to talk about it.

And that means what that means for the rest of us. Radius check.

Now, this is we figure out how far this thing actually reaches.

So here's the question I want you to sit with. Where does your company end?

Think about that.

Most people, if you ask them to draw a their security perimeter, they

probably likely drawing around their office or maybe their laptops, maybe the cloud

stuff.

If they're sharp, that's not your perimeter. And it's never been your perimeter in the 15 years that you're in business.

in my sleep because I built systems for hundreds of

them.

Small shops, 10 people, you're selling something physical. Think about this.

who has your company's list of data right now? Your e-commerce platform, your payment processor,

the shipping and fulfillment provider, that's shit, Monk, in this story. Your email marketing

platform, that's Brevo. Your CRM, your accounting software, your support desk, your booking,

your scheduling tool, your payroll provider has employees, has everything. Your backup vendor

has a copy of it all. By definition, that's literally the product. That's 10 and I didn't

even try hard most shops i walk into and the real number is somewhere between 15 and 40 but nobody

in the building has ever written it down every single one of these companies have a bad tuesday

it puts all your customers addresses and internet and information and how will you find out about it

through an email after it's over not on your

get got by some

exotic ShipMonk

specific thing they got through a Metabase software ShipMonk didn't write that they did

but they installed because it was a good tool like that of any a thousand other companies who

install that system. So it's not just who do I trust, it's who do my vendors trust and what do

they install. That's the blast radius. It's not a circle around your building. It's a graph. It's a

node. Your vendors knows their software is a node. A hole anywhere upstream floods you entirely

downhill on you. You cannot audit that graph. And I want to be honest with y'all. I'm not trying to

sit here and stand y'all and telling you that running a 10 person shop, that you're going to

audit every software application, ShipMonk's, dashboards, software, et cetera. That's not a

real thing, but that doesn't mean that you're helpless. It means that you're solving a different

problem than you may first thought about. All right. Now, let me tell you something from the

the third party risk is

a whole

department including vulnerabilities the fortune 100 companies fortune 500 whether it's government

financial it doesn't matter whether these classified and unclassified networks and

sometimes what gets identified as the crown jewels when you do this type of work that

touches these environments you're not going to do anything without a review not a vendor not a cable

not a laptop there's paperwork on top of paperwork and it literally takes months to get anything done

and every department and team that works in these environments know about it they complain about it

but it's just the way it is and you know what's the half half of that process is a theater it's

theatrics it's a lot of check boxes exercises and someone just has to point to when it all goes bad

but the other half is real and the real half is stupidity something simple where someone can just

say hey this is a list of everyone who touches this data and someone owns that list that's it

but the part that actually works and it's the part that small business skip entirely and it's not

because it's expensive it's because no one ever told you some of us have to learn the hard way

It's a real thing. Meanwhile, a small shop signs up for a SaaS product.

That's S.A.A.S. Software as a Service. And they sign about sign up in about four seconds with a credit card number.

They check box. I agree to the terms and services agreement that none of us read.

But at the same token, all of that data, that customer data has the same exposure, zero review.

And I'm not even mad. How can you expect a small business team to run a six month audit on every vendor that they're using information?

They're sending newsletters, emails, blasts saying that, hey, you know what? We need to do this.

Now, here's the thing I really want to drill down on, because this is the piece that's specific to the story.

And it's the one that almost nobody thinks about. Everybody thinks about access.

who can get in? Passwords, MFAs, what are multi-factor authentications, permissions,

they're good, they're necessary. But almost nobody thinks about the data retention. How long does

this company actually have or keep my data? Even after I've unsubscribed or I found a new vendor,

I'm no longer doing business with them. Do you know that they still have your data?

Trezor didn't think about it did think about it in fact they wrote out a 90-day retention

in the contract they asked specifically and they got it in writing and they still got burnt by a

six-year-old orders that were stolen so understanding what this proves you cannot

verify deletion from the outside there's no api or proof that it's gone you can't usually do a diff

on their database. You can ask a vendor to delete your data, but it's no different from you going to

one of your exes and be like, yo, you know all those pictures that you took of me? I don't want

you to have them anymore. Delete them. And then you get a text back and they say, yeah, we deleted

it. Yeah, right. The problem is, is that when you deal with these businesses and they give you a

promise or a reassurance, you have to only take it as far as they give it to you. But somewhere

silently that data may still exist and they may

have legitimately tried to delete it but the checks

and balances of it was it actually remove is a whole nother conversation which leaves exactly

two levers that you could control one it

sounds simple but it's give them less every

optional

field in that software or that vendor that you're using is a field that can leak later on do they

really need the phone numbers of the customers do they need the date of birth do they need the

shipping address after the thing that they shipped and the return window is closed and you've never

collected any more data that data can be stolen if they're not if they're still keeping it why

are they still keeping it you can tell them hey if you manage my data delete that the reality of

is is that a tool that's no longer used but it's still in deployment in their environment can still

be a security risk that's not just fact that's

just not hearsay that's facts now to assume that

it does leaks and leaks unfortunately happen so what do we do next but if we look at that example

that we talked about Brevo and that was the

half of the crm tool 347 000 phishing emails

2,500 and people click on that why not because

they didn't know better but the email came from

a real sender though the the platform was real and the people that they were targeting were

actually really tree source customers so if you got an email from a vendor that that you do business

with and that your customer gets that email your customer says oh yeah they do business with them

So this is probably legitimate. And they actually had an order. Every single normal person is taught to check.

Well, do I know this company? Did I buy from all those gates were checked? Everything was passed.

There was existing order information.

And when that information was found by attackers, they were literally operating from the inside.

So the defense can't be, oh, you got a spot, a fake email.

The defense has to be a thing that even when the message is perfect, you have to be careful.

All right. Now it's time for the fix. Three things that you can do today.

And the first one is free that you can do today.

Every outside company that holds your customer or employee data, one row, each three

columns, who they are, what they have and who owns the relationship on your

side.

When you open up a bank statement and your credit card statements and you go

line by line and you look at every reoccurring charge, that likely is a vendor

and most honest inventory that you ever built because it's the one that nobody ever

really curates.

and I'm telling you right now don't be surprised as there's likely going to be at least two things

two vendors two subscription that you're still paying for still holding an open door for and

I promise you even on a personal or there was software that I was paying for my kids who are

now teenagers and the tool that I was a subscription I was paying for us for like when they were in

pre-k and I'm like why am I paying this five dollars but because it was so small amount

didn't pay no mind but the reality is everyone always finds something that they're paying for

that they should no longer be paying for or their subscription expired and they no longer do the

service you cannot protect though what you have never counted and when a vendor emails you at 6

p.m saying hey we had an incident the list and that difference of knowing between 10 minutes of

exactly what data was there and spending the next three days guessing and investigating it could be

the determination of whether your business continues to be successful or you take that PR

hit.

Next up, pick the top five from the list

of the ones that are holding your most sensitive

information. Send one email. What data of ours do you currently hold? How far does it go back?

And what is your retention schedule? That's it. The whole email. Now, I just spent 10 minutes

telling you that Trezor did this and got burned anyway. So why am I telling you to do it?

Two reasons. One, the answer itself is intelligence.

Plenty of vendors are going to come back with all of it and forever we hold your data.

And now you know that you can decide if you're good with that.

Two, and this is the real one.

Trezor got burned, but Trezor also knew within days exactly who to notify what was taken.

they were disclosing while other companies were still scrambling trying to find out what exactly

was done taking how it happened and the typical statement you'll see in the news is we're still

investigating that means that they didn't have a no they didn't have an audit and they're probably

never going to truly know the effect and just might as well say everyone was compromised the

list does not prevent the breach the list turns a mystery into a notification that's a whole lot

worth more than at a 6 p.m. on a Friday would you rather someone say I think you were hacked

or just someone says hey your phone number and your name was breached but nothing else

so two moves on your side phishing resistant logins pass keys where you can get them a real

authentication app and when you can't get those at least have SMS codes for anything else that

matters the whole point is that when not if your people's who your employees their emails their

phone ups end up in someone else's phishing set a convincing message doesn't hand out an account

just like that when there's controls over the message it is perfect because now it doesn't

depend on someone having to notice hey does that email sound off your customer side you can then

tell them what you will never do. But before that happens, put it on your website, put it in your

contracts, put it in the order that we will never text you a link or update your payment. We will

never call you and ask for a code because here's what a lot of folks miss. When your email vendor

gets popped, the phish that comes out to your customers, and that's phish with a P-H-I-S-H,

has your name on it. The trust that gets spent is yours. You're the one who has to defy it and

you're the one that has to send the letters out later disclaiming that hey a compromise happened

with one of our vendors but you're the one taking a hit and it's the one that when you have that

conversation before it went wrong then you seem better prepared both of those will map to lessons

that will live free in the community right now fix one the counting what you've actually got

that's module one the map the whole idea you can't secure things that you haven't drawn you don't

understand, don't exist, you don't know your retention rates, that's imperative. The fix

number three that we talk about, that's the login app. That'll be on module three, identity,

passwords, MFAs, pass keys, free. Go to it right now. There's even a quiz. It'll take five minutes

once you go through the lesson and test your knowledge and tell you this is something that

if you don't know about it now, you might find out about it the hard way and that's never the

where you want

so that's

the radius on this one a company that sells trust nobody got hit twice by two different vendors

without ever being hacked the thing that failed wasn't a firewall it was an email from 2021 that

said yeah we deleted that information now you have a vendor list like that too maybe you just

haven't written it down go write it down today and if you want the lessons the map the identity

the stuff all that will be in the community it's called inside the blast radius on the platform

Skool — skool.com. the foundation's track is free and the link is in the description come in there

share your story come argue with me tell me that i'm wrong that's what i always love because i

always can tell you this when I'm right I'm right and when I'm wrong I could have been right because

I could have been right about being wrong and one day I might be wrong but that day ain't today

this is your boy Q everything has a blast radius just find out how much yours goes peace