Yes, we know if user used the extension to connect to the Alby Account, and then of course we are aware of the account's usage. But we can't know keys or whatever you do with your node plugged in. So, basically - nothing.

If you download malicious software that pretends to be Alby Extension, then your keys might be compromised. If you download verified extension from GitHub (recommended) or browser appstore - then there shouldn't be risk.

No hack on Alby premises could compromise user keys, those are stored locally on users' machines