Image Credit: keyst.one
- Keystone disclosed an unauthorized website breach exposing customer shipping and order details.
- The hardware wallet maker confirmed a third party accessed records via Shopify API activity.
- Keystone did not disclose affected purchase dates or the total number of impacted customers.
Keystone disclosed on Oct. 24 that a website breach exposed customer shipping and order information, warning buyers about impersonation scams. The incident also puts its data-retention promises under scrutiny, with published pages describing different deletion procedures.
Keystone Confirms Access to Shipping Records
The hardware wallet maker said it detected unauthorized website access on Oct. 20. After reviewing application programming interface (API) activity with Shopify, it confirmed on Oct. 23 that a third party had obtained customer shipping information.
Exposed records included names, contact information, shipping addresses and order details, including products purchased and prices paid. Keystone said payment-card and bank details, recovery phrases, private keys and wallet passwords were not exposed.
The company said it blocked unauthorized access, fixed the vulnerability and began notifying affected customers by email. It also announced an internal investigation and said a fuller incident report would follow.
Keystone Publishes Different Data-Deletion Conditions
Keystone’s Privacy Promises page says shipping information is automatically deleted 180 days after an order is placed. It also offers deletion on request immediately after delivery.
Order information is erased for customers who have not purchased within the previous 180 days. That condition ties deletion to customer inactivity, rather than the age of each order.
The support FAQ describes requested deletion for shipping information older than 180 days, provided no order disputes remain. Processing takes two to three weeks, Shopify handles final deletion, and city and country records remain.
Keystone did not disclose the affected purchase dates, leaving unclear whether exposed records fell within its promised deletion periods. It also did not specify the number of affected customers.
Keystone Warns Buyers About Follow-Up Scams
Keystone warned that attackers could impersonate the company through calls, messages, emails or physical mail. Fraudulent approaches could offer refunds, replacement devices or help correct orders.
The company urged customers not to disclose recovery phrases or private keys, or enter a recovery phrase into an unsolicited device. It advised avoiding unexpected links and opening its official website directly.
