Coldcard Suspends Automatic Data Deletion Following Security Incident

ChainCatcher report: Coldcard, a hardware wallet manufacturer, has issued an announcement updating its customer data retention policy. Due to a security incident disclosed on July 30 that triggered legal and compliance requirements, the company has temporarily suspended its automatic customer data deletion process. Previously, Coldcard’s standard practice was to automatically erase customer records after 120 days, retaining only the user’s email address and country of residence, while allowing customers to request immediate deletion of their data at any time after product delivery. Coldcard stated that, due to the security incident involving ongoing and potential legal proceedings, the company is obligated to retain records that may be relevant to litigation; therefore, customer data that would normally be deleted on schedule will be temporarily preserved until legal conditions permit the resumption of normal procedures. However, users may still request that Coldcard handle their personal information in accordance with the original data retention policy. Users wishing to exclude their data from this legal retention period may contact official customer support to make a request. Coldcard emphasized that retained data will be strictly protected and accessible only to authorized personnel, and will not be used for any purpose other than fulfilling legal obligations. The company will restore its previous automatic data deletion process as soon as legally permitted.