The European Union has implemented new cybersecurity mandates specifically targeting companies involved in developing cryptocurrency hardware and software wallets. According to an announcement by the European Commission, the Cyber Resilience Act came into effect on Friday, obliging swift early warnings within 24 hours whenever a significant security flaw is actively exploited.
What is the New Notification Timeline?
Manufacturers are now required to submit an initial notification for severe security vulnerabilities within 24 hours. This is followed by a more detailed report within 72 hours. After corrective measures are prepared, a final report must be delivered within 14 days. For critical incidents, additional reporting obligations extend up to a month.
The European Commission stated that the new notification rules aim to better protect consumers and businesses from cyber threats.
These regulations extend beyond just crypto wallets, enveloping all products offered in the European Union market that feature digital elements. The measure is part of the EU’s broader cybersecurity strategy.
Are There Penalties for Non-Compliance?
Firms failing to comply with Articles 13 and 14 of the act risk administrative fines reaching up to 15 million euros or 2.5% of their global annual revenue, whichever amount is greater. Additionally, providing incorrect, incomplete, or misleading information can incur an extra fine of up to 5 million euros.
Why Are Recent Data Breaches Highlighting Its Importance?
This regulatory step follows weeks after two popular hardware wallet providers disclosed breaches involving user data. Such incidents have increased concerns within the industry regarding phishing attacks and social engineering risks.
On September 4, Trezor announced that the number of high-risk users affected by a data breach via its shipment partner ShipMonk surged from the initial estimate of 14,000 to 67,000.
Recently, Trezor and BitBox warned their users about phishing emails masquerading as urgent security alerts following suspicious breaches in third-party email services. Meanwhile, in June, the layer 1 blockchain network Zilliqa revealed a vulnerability in its Ledger application, potentially allowing attackers to recover users’ private keys from publicly available on-chain data. These instances underscore the importance of swiftly addressing security gaps in wallet infrastructures.
- The EU Cyber Resilience Act aims for quicker incident response to safeguard digital products.
- Fines for non-compliance can reach millions, urging rigorous adherence to cybersecurity protocols.
- Recent security breaches emphasize the necessity for these new cybersecurity measures.
With the rapid advancements in the crypto sector, these regulations highlight the EU’s commitment to reinforcing digital security frameworks. This initiative not only sets a precedent for global regulatory standards but also reflects a proactive approach towards managing emerging cyber risks in this volatile market landscape.
