- Exposed records included customer names, contact details, shipping addresses and purchase information.
- The company said private keys, recovery phrases and payment details were not exposed.
- Unverified customer reports raise questions about the promised 180-day deletion policy.
Keystone disclosed a customer data breach on October 24 after detecting unauthorized website access four days earlier. The hardware wallet maker said an outside party obtained names, contact details, shipping addresses and order records. It confirmed the exposure on October 23 after reviewing Shopify API activity, while saying wallet credentials and payment information remained unaffected.
Keystone says wallet credentials were not exposed in breach
According to its public disclosure, the stolen records included products purchased and their prices. Payment cards, bank details, recovery phrases, private keys and wallet passwords were outside the reported exposure.
The company said it blocked access, fixed the vulnerability and began emailing affected customers. However, its initial statement did not disclose the customer count, attacker identity or precise entry method.
Reviewing Shopify API activity does not establish that Shopify’s underlying platform was compromised. The disclosed facts concern unauthorized access involving the merchant’s online store.
Keystone warned that criminals could impersonate its staff through calls, texts, emails or physical mail. Fake refunds, replacement devices and requests to correct shipping details were among the potential scams identified.
Accurate purchase records can make those approaches more convincing. Customers were told to avoid unexpected links and never enter recovery phrases into devices they did not order.
Keystone faces questions over its 180-day deletion promise
The company’s Privacy Promises page says it automatically deletes shipping information 180 days after an order. Its privacy policy instead describes erasing order records for customers who haven’t purchased in the previous 180 days.
Those formulations differ: one refers to individual orders, while the other refers to a customer’s latest purchasing activity. The pages do not explain whether that distinction changes retention in practice.
Some customers claim they received breach notices concerning purchases older than the advertised retention period. These accounts remain unverified and do not independently establish which records the attacker obtained.
Keystone has not publicly established the age range or geographic distribution of affected records. The company said its investigation remained underway and promised a detailed incident report in the coming days.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
