This Week in Cybersecurity: Trezor’s 7-Year Data Lie, Wi-Fi Motion Tracking, and the ReliaQuest Breach
They said they deleted your data. They didn’t.
Trezor makes hardware wallets. If you own crypto you probably know the name. Their whole brand is built on one promise: your stuff is safe with us.
Last week they disclosed that 67,000 more US customers had their personal data stolen—names, emails, phone numbers, home addresses, and order numbers.
But here’s the part that matters.
Those 67,000 records were from orders placed between 2019 and 2021. Old data. Five to seven years old. Data that was supposed to be gone.
Trezor has a 90-day data retention policy. After 90 days all customer shipping data gets deleted. That’s in the contract with their fulfillment partner ShipMonk. Trezor asked multiple times if the data was deleted. ShipMonk said yes. In writing.
It wasn’t.
The data sat on ShipMonk’s servers for years. Quietly. Until ShinyHunters exploited a critical vulnerability in ShipMonk’s analytics platform, created admin-level access, and downloaded everything.
Trezor’s own statement: “We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.”
Disappointed. That’s the word they used.
80,000 customers whose home addresses are now floating around the internet—people who own crypto hardware wallets, which means they likely hold significant digital assets—and the word is “disappointed.”
Here’s why this should scare every business owner reading this.
“You have vendors. Shipping partners. Billing platforms. Support tools. CRM integrations. Every one of them holds some of your data or your customers’ data. And you trust them to handle it responsibly.”
But do you verify?
Do you actually check that data gets deleted when it’s supposed to? Do you audit what your vendors are holding? Do you have visibility into their security practices beyond the checkbox they send you once a year?
Trezor did everything right on their end. 90-day policy. Written requests. Contractual agreements. Their own systems were never touched.
And none of it mattered. Because their vendor lied about deleting the data and got hacked with records that shouldn’t have existed.
Your router is watching you walk around your house.
And it can tell the police.
Two weeks ago Comcast launched a free feature called WiFi Motion on millions of Xfinity routers. No camera. No sensors. Just the radio waves your router is already emitting bouncing off the walls and objects in your home.
Your body disrupts the signal. The router notices. Logs it. Timestamps it. Sends an alert to the app.
Comcast is marketing it as free home security. And honestly the technology is impressive. No cameras means no footage to hack. No separate devices to install. Just your router doing something it was technically always capable of doing.
Sounds great until you read the fine print.
Buried in Comcast’s support documentation is a clause that says motion data “may be disclosed to law enforcement in response to a subpoena, court order, search warrant, or other legal process,” and in some cases “without further notice to you.”
Let me translate that.
You enable this feature. Your router starts logging when you’re home. When you’re moving around. When you walked through the kitchen at 3am. When nobody moved for 12 hours. When there was activity in a room at a time you normally aren’t there.
That data sits on Comcast’s servers. And if law enforcement asks for it with a court order… Comcast can hand it over without telling you.
“Your router just became a witness.”
I work in technology. I help businesses secure their networks and their data. I believe in the power of these tools. But there’s a line between a tool that protects you and a tool that watches you. And that line gets real blurry when the watching happens inside your home and the data goes somewhere you can’t control.
A cybersecurity company warned the world about a hacking group on Monday. By Friday that same group had breached them.
ReliaQuest—a company that sells threat detection and security operations to enterprises—posted on X on August 17th warning everyone about ShinyHunters. Said the group was registering fake domains. Impersonating IT staff. Running voice phishing campaigns at scale.
ShinyHunters saw the post. And replied publicly: “Who’s hunting who?”
Five days later they proved it wasn’t a bluff.
The company that warns people about phishing… got phished.
Now to ReliaQuest’s credit—their security controls actually worked after the initial breach. Device-trust policies blocked the attackers from reaching internal applications. No customer data was accessed. No systems were compromised beyond that one dashboard session. No persistence was established.
They caught it fast. Contained it fast. And published the full breakdown publicly so others could learn from it. That’s how you respond to an incident.
But here’s the part I can’t stop thinking about.
This is a cybersecurity company. Their employees think about social engineering every single day. They literally published a warning about this exact attack five days before it happened to them.
And it still worked.
“Because that’s how social engineering works. It doesn’t matter how much you know. It matters what you do in the moment when someone calls you by name, sounds like they belong, and asks you to do something that feels routine.”
If a cybersecurity company’s own employee can fall for this… your team can too. Mine can too. Nobody is immune.
MFA is better than no MFA. But if your MFA is a push notification that someone can approve while on a spoofed call with a convincing voice… it’s not enough anymore. FIDO2 physical keys and phishing-resistant authentication are the new minimum bar.
Authored by our certified engineers, security architects, and leadership team. Want to protect your business against vendor risk and credential attacks?
