Hardware wallet firm Trezor alerted users to a security breach on its platform that may have impacted a small portion of its customer base that interacted with Trezor Support since December 2021.
In a blog post on Saturday, Trezor said it was investigating unauthorized access to the third-party supporting ticketing portal that took place on Jan. 17.
🚨Security Alert 🚨
On January 17, 2024, the third-party support ticketing portal we use encountered unauthorized access.
Potentially impacted data are limited to user emails and names/nicknames that contacted our customer support team.
We want to assure you that this does not… pic.twitter.com/hnxBYBlvlO
— Trezor (@Trezor) January 20, 2024
“While this represents a small part of our entire user base, up to 66,000 contacts were present in the system during that time,” said Trezor in the blog post.
The firm emphasized that no user funds had been compromised in the incident, but the affected users could potentially have their contact details, including their names and emails exposed, leaving them vulnerable to potential phishing attacks.
During the investigation, Trezor observed that a malicious actor had already contacted 41 users via email and requested information about their seed phrases.
“We have reviewed these interactions and alerted each of the contacted users within an hour of the incident. No recovery seed phrases have been disclosed,” said Trezor.
Trezor has suffered a number of security issues over the years, including an information leak in 2019 and two critical vulnerabilities in 2020 that exposed seed phrases.
In May 2023, cryptocurrency recovery firm Unciphered claimed that it was able to extract the private keys from Trezor T wallets through an exploit developed in-house that would be “unfixable” even with firmware upgrades.
