# Hardware Wallet Firm Trezor Says 66,000 Users Impacted by ‘Security Incident’

Source: https://unchainedcrypto.com/hardware-wallet-firm-trezor-says-66000-users-impacted-by-security-incident
Kiwi News: https://news.kiwistand.com/stories/Hardware-Wallet-Firm-Trezor-Says-66000-Users-Impacted-by-Security-Incident?index=0x65aeb939bddd51afa835a120e0ecf0ec158e22fb232e4fc8b4d606267a5f49a68b547b8b
Submitted by tim on 2024-01-22 UTC, 6 upvotes, 0 comments

## Summary

Hardware wallet firm Trezor is investigating unauthorized access to a third-party support ticketing portal on January 17, 2024, which may have exposed contact details of up to 66,000 users. Potentially exposed data is limited to user emails and names or nicknames of people who contacted its customer support team. Trezor said no user funds were compromised, but affected users could face phishing attacks. The firm said a malicious actor contacted 41 users by email asking for their seed phrases, and that no recovery seed phrases were disclosed.

## Article

Trezor is investigating a security incident that took place on Jan. 17, where 66,000 users may have had their contact details exposed.

Posted January 21, 2024 at 11:25 pm ET.

Hardware wallet firm Trezor alerted users to a security breach on its platform that may have impacted a small portion of its customer base that interacted with Trezor Support since December 2021.

In a blog post on Saturday, Trezor said it was investigating unauthorized access to the third-party supporting ticketing portal that took place on Jan. 17.

????Security Alert ????

On January 17, 2024, the third-party support ticketing portal we use encountered unauthorized access.

Potentially impacted data are limited to user emails and names/nicknames that contacted our customer support team.

We want to assure you that this does not… pic.twitter.com/hnxBYBlvlO

— Trezor (@Trezor) January 20, 2024

“While this represents a small part of our entire user base, up to 66,000 contacts were present in the system during that time,” said Trezor in the blog post.

The firm emphasized that no user funds had been compromised in the incident, but the affected users could potentially have their contact details, including their names and emails exposed, leaving them vulnerable to potential phishing attacks.

During the investigation, Trezor observed that a malicious actor had already contacted 41 users via email and requested information about their seed phrases.

“We have reviewed these interactions and alerted each of the contacted users within an hour of the incident. No recovery seed phrases have been disclosed,” said Trezor.

Trezor has suffered a number of security issues over the years, including an information leak in 2019 and two critical vulnerabilities in 2020 that exposed seed phrases.

In May 2023, cryptocurrency recovery firm Unciphered claimed that it was able to extract the private keys from Trezor T wallets through an exploit developed in-house that would be “unfixable” even with firmware upgrades.