YubiKey is the hardware security-key product line of Yubico AB (publ), a publicly registered Swedish company headquartered in Stockholm, with an international affiliate group spanning the US, Canada, Germany, the UK, Australia and Singapore. Yubico's Privacy Notice discloses that its websites collect account/newsletter data voluntarily provided by visitors plus automatic browser and IP-address logging, and that it uses Google Analytics for web analytics; it states it does not sell personal information under the CCPA, and its published sub-processor list is limited to Yubico's own affiliate entities rather than third-party ad or data-broker destinations. In September 2024 Yubico published Security Advisory YSA-2024-03 ("EUCLEAK"), disclosing a moderate-severity (CVSS 4.9) side-channel vulnerability in a third-party cryptographic library (Infineon) used in firmware prior to 5.7, reported through coordinated disclosure by researcher Dr. Thomas Roche of NinjaLab; Yubico shipped fixed firmware using its own cryptographic library and removed the Infineon dependency. This is not Yubico's first Infineon-related advisory — YSA-2017-01 disclosed weak RSA key generation from the same third-party vendor's library — and the company maintains a public, dated security-advisory archive going back to 2015 alongside a published coordinated-vulnerability-disclosure policy.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
8 new sources on file for YubiKey.
YubiKey's file gained 8 new sourced claims since its last review.
Yubico's Privacy Notice states its websites collect voluntarily provided data (name, email) when visitors sign up for newsletters, surveys, deals, webinars or events, and separately automatically receive and log browser-level data such as IP address, language preferences, and pages visited for site operation and security purposes.
Yubico's published Sub-processors page discloses the company's complete international affiliate group by legal name and country of registration: Sweden, the USA, Canada, Germany, the UK, Australia, and Singapore.
Yubico's Legal Imprint page names the operating entity as Yubico AB (publ), gives its registered office address in Stockholm, Sweden, its company registration number (559278-6668), a VAT ID, and an authorized representative.
Yubico's Privacy Notice states, under its California Notice at Collection, that the company does not sell personal information as defined by the California Consumer Privacy Act.
Yubico publishes a dated Coordinated Vulnerability Disclosure policy stating the company is committed to maintaining the security and privacy of its products and customers, providing a dedicated security contact email and a published PGP key for encrypted vulnerability reports.
Yubico's public Security Advisories archive lists Security Advisory YSA-2017-01, 'Infineon weak RSA key generation' — a vulnerability in the same third-party cryptographic vendor's library that would recur seven years later as the root cause of the 2024 EUCLEAK advisory (YSA-2024-03), documenting a repeat root-cause dependency rather than a single isolated incident.
Yubico's Security Advisory YSA-2024-03 discloses a moderate-severity (CVSS 4.9) vulnerability in Infineon's cryptographic library affecting YubiKey 5 Series, Security Key Series firmware prior to 5.7, and YubiHSM 2 firmware prior to 2.4.0, handled via coordinated disclosure: researcher Dr. Thomas Roche of NinjaLab notified Yubico on April 19, 2024, Yubico released fixed 5.7 firmware using its own cryptographic library on May 21, 2024, and published the advisory on September 3, 2024, with no evidence found that the vulnerability requires anything less than physical possession of the device plus specialized equipment to exploit.
Yubico's Privacy Notice discloses the use of Google Analytics, a third-party web-analytics service provided by Google Ireland Limited, to understand site visitor behavior via cookies, while stating the collected data is not combined with personally identifiable information.