Keystone, a hardware wallet maker, said a security incident at its online store exposed customer information to an outside party. According to the company, the compromised data includes names, contact details, shipping addresses, purchased products and pricing information.
Keystone said it detected abnormal access on Oct. 20. During a review of Shopify API activity on Oct. 23, it determined that a third party had exfiltrated data. The company said highly sensitive financial and wallet credentials were not affected.
What Keystone says was exposed
The company said the breach did not involve payment card information, bank account details, wallet recovery phrases, private keys or passwords. It added that it has blocked the access route used in the incident and fixed the underlying vulnerability.
Keystone is now contacting affected customers by email. It has not said how many users were impacted, and it has not yet identified the specific attack vector. The company said it plans to publish a more detailed incident report after its investigation progresses.
Questions over retained order data
The incident has also drawn scrutiny to Keystone’s stated data retention practices. The company had previously said it permanently deletes shipping information 180 days after a product order.
However, some users said they received breach notifications tied to purchases made more than two years ago or to orders older than 214 days. Those reports have fueled questions about whether older customer data remained accessible despite the 180-day policy.
One user also reported receiving an impersonation call from someone who allegedly knew details of a 2024 order. That claim remains unverified, and Keystone has not provided a detailed public explanation on whether its handling of stored shipping data matched its stated policy.
Broader pattern in hardware wallet security incidents
The disclosure adds to a series of customer-data incidents involving hardware wallet companies and their commercial systems rather than wallet keys themselves. Similar cases have previously hit other firms in the sector.
Trezor reported a leak at a shipping partner that exposed information for about 14,000 customers, with later reporting indicating an impact on 67,000 U.S. customers. SafePal has also disclosed a flaw in its order lookup system that exposed data for about 40,000 users.
Scam risk and next steps
Keystone warned that the exposed information could be used in phishing attempts and impersonation scams. The company said users should be wary of unsolicited contacts offering refunds, replacement devices or order changes.
It also advised customers not to click suspicious links or provide wallet recovery phrases. For now, the confirmed next step is Keystone’s promised follow-up report, which is expected to address the still-unknown scope of the breach and how the data was accessed.
Source: en.bloomingbit.io