Trezor wallet : breach exposes data of 60,000+ customers

[paid2]

It's just to spread the word: be careful, verify the emails and links you receive if you're using a Trezor, there's been a leak from their database recently.   
   
Article for reference: https://www.bleepingcomputer.com/news/security/trezor-support-site-breach-exposes-personal-data-of-66-000-customers/
Official announcement: https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8

[joniboini]

Do they name this third-party provider or not? I saw speculation that it was Mailerlite or something, but it was not confirmed. If they plan to move on or stop using that provider, is there any reason they don't publish the name? That should allow people to be more alert if anyone receives suspicious e-mails from the same e-mail service. Understandably, they use a third-party provider for their support channel, but storing users' data for years does not sound great. Maybe they can move it offline or something else instead of relying on a third-party provider to secure them. CMIIW.

[Charles-Tim]

Do they name this third-party provider or not? I saw speculation that it was Mailerlite or something, but it was not confirmed. If they plan to move on or stop using that provider, is there any reason they don't publish the name? That should allow people to be more alert if anyone receives suspicious e-mails from the same e-mail service. Understandably, they use a third-party provider for their support channel, but storing users' data for years does not sound great. Maybe they can move it offline or something else instead of relying on a third-party provider to secure them. CMIIW.

We do not care about the third party than Trezor was unable to securely save their customers information and we have Trezor to blame. This is not the first time that Trezor customers information were breached for hackers to use the information in phishing attack. All that I know is that those that subscribed to Trezor news letter with their email were affected.

[Zed0X]

Do they name this third-party provider or not? I saw speculation that it was Mailerlite or something, but it was not confirmed. If they plan to move on or stop using that provider, is there any reason they don't publish the name?

It makes you wonder if there was an agreement not to disclosed their name since they were able to point out Mailchimp back in 2022 for a similar breach. Maybe because they haven't finalized their investigation yet?

[notblox1]

It's just to spread the word: be careful, verify the emails and links you receive if you're using a Trezor, there's been a leak from their database recently.   

I hope nobody lost coins or send anything to scammers, but Trezor should get your shit together !
How many times we need to hear the same story about hacked database from hardware wallets and information form customers until you learn to protect it correctly

[paid2]

I hope nobody lost coins or send anything to scammers, but Trezor should get your shit together !
How many times we need to hear the same story about hacked database from hardware wallets and information form customers until you learn to protect it correctly

You're absolutely right. What's more, we learn that it was customer support that had its data stolen... They really must keep their support cases for a very long time, because I imagine that for Trezor 66,000 cases means several years of support.

Maybe this kind of repeated incidents will push users to consider other solutions like an airgapped electrum etc...

[robelneo]

It's good to know that no users' funds have been compromised or else that would be the end of Trezor wallet there are thousands of users of this hardware wallet, and it can create a negative impact on the hardware wallet industry.
"We want to stress that none of our users' funds have been compromised through this incident," reads the announcement. "Your Trezor device remains as secure today, as it was yesterday," the company added.
The hackers and scammers will keep on trying to create a breach so people in every industry that is involved in securing coins should keep upgrading to combat these hackers and scammers, and users should continue to learn and educate themselves on how to secure their account and their investment.

[Yamane_Keto]

I hope nobody lost coins or send anything to scammers, but Trezor should get your shit together !
How many times we need to hear the same story about hacked database from hardware wallets and information form customers until you learn to protect it correctly

I think that the database that was hacked is for support and belongs to a third party, so Trezor must improve the choice of third parties with whom it shares data or not.
Repeating such a scam makes anyone check the email several times before clicking on it and be careful not to share his email publicly or not to use aliases.

[paid2]

I think that the database that was hacked is for support and belongs to a third party, so Trezor must improve the choice of third parties with whom it shares data or not.
Repeating such a scam makes anyone check the email several times before clicking on it and be careful not to share his email publicly or not to use aliases.

You're right, it's the customer support database that's been hacked. I find it even worse to entrust private information to third parties than if they'd been hacked themselves (from a marketing/company reputation point of view I mean).

I also recommend everyone to use an alias system for their emails, it greatly limits the risks and is an excellent practice. Unfortunately, it's still under-exploited, and should be recommended more often.

[NikeFit_7777]

Does anyone use this (cold) wallet? If yes, please answer me a few questions.

— Does Trezor have a recovery function like Leadger?
— Does Trezor have forced firmware update? If I don't want to update the firmware, can I not do it? Will I have access to my funds?
— Who has had problems with the device itself?

If you have something to say, not on the questions above (that would be your experience) - feel free to share information too.

P.S. Appreciate whoever answers the above questions. Never used this device, really interesting. 

[examplens]

The problem came from an external company that takes care of email services for the Trezor. Sending newsletters and similar. Almost every serious company works like that. A similar thing happened to some other "big" names, it was talked about here on the forum https://www.altcoinstalks.com/index.php?topic=316040.msg1478541#msg1478541

Does anyone use this (cold) wallet? If yes, please answer me a few questions.

— Does Trezor have a recovery function like Leadger?
— Does Trezor have forced firmware update? If I don't want to update the firmware, can I not do it? Will I have access to my funds?
— Who has had problems with the device itself?

I have both wallets, Trezor and Ledger. I primarily and almost exclusively use Trezor, while Ledger is more for experimentation (for example, I only use it for tokens and some rare altcoins)

Answer to your question (if they are not rhetorical)
- No
- No
- Since I have Trezor One, my only problem is that I don't have support for some of the more important Altcoins.

btw. I use the Trezor wallet almost on a daily basis, it's not just for hold.

[dkbit98]

Does anyone know what is the name of that Trezor partner service?
I don't know if this recent trezor leak was added to haveibeenpwned.com website, but I recommend checking your old email addresses there.
It's not a good idea to have one email address for everything, and signing up for any crypto related newsletter with that email is even worse.

[Yamane_Keto]

— Does Trezor have a recovery function like Leadger?
— Does Trezor have forced firmware update? If I don't want to update the firmware, can I not do it? Will I have access to my funds?
— Who has had problems with the device itself?

No, the Trezor wallet code is open source https://github.com/trezor. If they add anything, you will hear from the developer reviews.

No, if the private keys manage to leave your wallet then you should seriously consider selling Trezor.

Hardware related issues are not a usual thing and you can read more about them https://forum.trezor.io/t/about-the-hardware-issues-category/6295/8
Most likely, your experience will be good. Watch some videos on YouTube, and if you want to make a comparison between HWs, create a separate topic for that.

[NikeFit_7777]

I have both wallets, Trezor and Ledger. I primarily and almost exclusively use Trezor, while Ledger is more for experimentation (for example, I only use it for tokens and some rare altcoins)

Answer to your question (if they are not rhetorical)
- No
- No
- Since I have Trezor One, my only problem is that I don't have support for some of the more important Altcoins.

btw. I use the Trezor wallet almost on a daily basis, it's not just for hold.

I didn't ask a question for the sake of asking a question, I'm genuinely curious. I have never used this device before. It's great that Trezor doesn't have a recovery function. Leadger - should have made this feature free. I don't understand how you can store your cryptocurrency there if your cid phrase is known to someone else. Where is the anonymity they are talking about? So they say one thing and do another? So it turns out. 

P.S. Leadger I don't have, but so far I like trezor better in that regard. Thanks for replying! It was important to me. 

[examplens]

Does anyone know what is the name of that Trezor partner service?
I don't know if this recent trezor leak was added to haveibeenpwned.com website, but I recommend checking your old email addresses there.
It's not a good idea to have one email address for everything, and signing up for any crypto related newsletter with that email is even worse.

Here is my case.
Earlier, I signed up for the Trezor newsletter with one address, which otherwise only serves me for such things. And that's where I got that phishing email mentioned. It seems that they stopped using that service at the moment, so by checking I get this:

We have found some suspicious activity in this client's account and this link had been blocked for your safety.

We apologise for any inconvenience caused.
If you think the link is safe, please contact the sender of the email.

Later (January 2018) when I bought a Trezor wallet, I did it using my private email address and I didn't get any phishing offers on it. Also, email correspondence during the purchase flowed through the MailChimp service (by Trezor).

Lately, I've been deleting all emails, so I have very few of them in my inbox, but here I found an interesting one. It's from
Sep 27, 2022, 9:00 AM

We're back! Confirm your newsletter preferences to stay up to date

We’ve been working hard to set up our new mailing platform to ensure you get the content you want and need in the safest way possible.

all the links from this email lead me to the page with the message I quoted above.