Some records exposed in the breach date to 2019, years beyond the 90-day retention Trezor said its partners had agreed to.
