Good post - thanks for the heads-up !

The question that jumped into my mind was where or how the scammers found a list of Trezor owners to send the letters to. It seems quite well targetted.

It might not be that Trezor themselves have had a data leak. I can see it as just as likely that the scammers paid some sap in a third world bank call centre who has never seen $10,000 before and doesn't make that in ten years. All they want is a list of debit or credit card payments where Trezor or SatoshiLabs have received funds, and the names and addresses of the card holders. Or perhaps it was an Amazon leak - or anywhere else you can buy the devices where a human can extract a list of customer names and addresses.