Trezor support portal breach exposes contact data of 66,000 users

Trezor, the Czech hardware cryptocurrency wallet maker operated by SatoshiLabs, disclosed that an attacker gained unauthorized access to a third party support ticketing portal it used, exposing the contact details of up to 66,000 people who had contacted Trezor Support since December 2021.

The company said it detected the access at 20:20 CET on January 17, 2024 and revoked it immediately, contacting the third party provider six minutes later. The exposed records contained names or nicknames and email addresses. Trezor said postal addresses and phone numbers were not disclosed.

Before access was cut off, the attacker emailed 41 users directly and asked them to supply their recovery seed phrases, the master secret that controls a wallet's funds. Trezor said no seed phrases were disclosed and that no customer funds were compromised. It alerted those 41 users within an hour and emailed all 66,000 potentially affected users over the following days from its [email protected] address.

Trezor stressed that the hardware wallets themselves were unaffected, saying a customer's device remained as secure as it had been the day before. It warned recipients that the exposure left them at heightened risk of phishing, and said it was reassessing its relationship with the third party provider, which it did not name.