Nearly 14,000 crypto holders face security risk after data breach
Financial Times
The personal information of close to 14,000 crypto holders has been exposed in a data breach affecting hardware wallets, one of the methods considered most secure for storing keys that grant access to digital tokens, leaving affected users potentially vulnerable to criminal targeting. Trezor, a seller of hardware crypto wallets, disclosed on Thursday that a data breach at one of its shipping providers exposed the names, addresses, phone numbers and email addresses of 11,742 buyers of its devices, while a further 1,947 customers had their names, domicile cities and email addresses compromised.
The breach comes amid a rise in both physical and online attacks targeting crypto holders as criminals attempt to seize their assets. The Prague-based company sells hardware wallets, small devices resembling USB sticks that let users store private keys offline, away from internet-based hacks. Known as cold wallets, these devices are designed to be the least vulnerable method for crypto holders to protect access to their tokens. Demand for them has grown as investors look for safer ways to secure their holdings amid record numbers of hacks at crypto venues.
The breach comes amid a rise in both physical and online attacks targeting crypto holders as criminals attempt to seize their assets. The Prague-based company sells hardware wallets, small devices resembling USB sticks that let users store private keys offline, away from internet-based hacks. Known as cold wallets, these devices are designed to be the least vulnerable method for crypto holders to protect access to their tokens. Demand for them has grown as investors look for safer ways to secure their holdings amid record numbers of hacks at crypto venues.
Mexico expands anti-money laundering oversight with tighter controls on crypto, casinos and real estate
El País
Mexico is broadening its anti-money laundering efforts. The government has issued new regulations requiring a wide range of businesses operating outside the traditional financial system to strengthen their client identification, transaction monitoring and detection of potentially illicit funds. The rules apply to real estate developers, car dealers, nonbank lenders, casinos, and art and jewelry dealers, with particular focus on cryptocurrency platforms.
The reform sets new requirements for service providers engaged in what regulators classify as vulnerable activities, expanding the information these firms must collect, retain and share with financial intelligence authorities. The updated legislation, known as LFPIORPI, also mandates automated monitoring systems, annual audits and stricter procedures for identifying beneficial owners, meaning the individuals who ultimately own or control a business. The aim is to improve tracing of the true owners behind money flows.
The agreement, published by Mexico's Ministry of Finance, arrives amid mounting pressure on the country to curb financial flows tied to criminal organizations. The United States has intensified its scrutiny of Mexican cartel networks through intelligence, security and resource-monitoring tools, and has recently increased reward offers in its effort to counter the Jalisco New Generation Cartel (CJNG), which Washington has designated a foreign terrorist organization, a classification that has significantly heightened pressure on the group and its affiliates.
APRA to penalise Bendigo Bank $8m over robustness of cyber and technology systems
The Australian
Australia's prudential regulator will penalize Bendigo Bank $8 million over shortcomings in the regional lender's cyber security and systemic safeguards meant to protect the financial system from bad actors. Bendigo Bank agreed to the penalty deal with the Australian Prudential Regulation Authority (APRA), with terms disclosed publicly after media inquiries.
Bendigo Bank confirmed it agreed to the fine over breaches of the Banking Act occurring between 2020 and 2023, and will additionally cover $2.6 million in court costs related to the matter. The penalty concerns the bank's former Alliance Bank business, which closed in September 2024. Alliance Bank experienced a major cyber security incident in March 2023, in which 250 accounts were compromised and $140,000 was misappropriated.
