A significant data breach involving the hardware wallet manufacturer Trezor has expanded to include approximately 67,000 additional customer records. According to Decrypt, this widening of the security incident reveals personal information that was compromised beyond what company officials initially disclosed.
The newly exposed dataset contains user details dating back as far as 2019. This timeline presents a notable discrepancy regarding data retention policies previously established by Trezor and its business partners. Industry standards and prior agreements stipulated that partner companies would retain sensitive customer information for no longer than ninety days following the last transaction. The presence of records from nearly four years ago directly contradicts these agreed-upon limits.
The implications of this finding suggest a potential lack of oversight or enforcement regarding how third-party service providers manage user data over extended periods. While Trezor had communicated specific retention windows to mitigate privacy risks, the actual storage practices appear to have exceeded those boundaries significantly. Consequently, customers may now face prolonged exposure to unauthorized access rather than the limited window originally promised.
The breach underscores ongoing challenges in cryptocurrency security infrastructure where third-party data handling often remains opaque. As investigators continue to assess the full scope of this incident, the contrast between stated retention policies and actual record longevity highlights a critical vulnerability in how wallet manufacturers delegate sensitive information management. Users are advised to review their own exposure levels given that compromised identities from 2019 remain active within the breached dataset.
