The European Union has introduced new cybersecurity reporting requirements for providers of hardware and software cryptocurrency wallets. Under the Cyber Resilience Act, companies must now report actively exploited bugs or severe security vulnerabilities within 24 hours of discovery.
The regulatory framework mandates a multi-stage reporting process. Following the initial 24-hour warning, firms are required to submit a full notification within 72 hours. A final report must be provided 14 days after corrective measures are implemented, or within one month for severe incidents.
Non-compliance with these rules carries significant financial penalties. Companies may face administrative fines of up to €15 million, or 2.5% of their worldwide annual turnover, whichever is higher. Providing misleading or incomplete information can result in fines of up to €5 million.
The European Commission stated that these measures aim to enhance the protection of consumers and businesses against cyber threats. The regulations apply to all products with digital elements available within the European Union and are part of the broader regional cybersecurity strategy.
The implementation follows recent security incidents in the sector. In September, Trezor reported that 67 000 customers were affected by a data breach at its shipping partner, ShipMonk. Additionally, both Trezor and BitBox recently issued warnings regarding phishing attempts targeting their users.
