Hardware wallet maker Keystone said unauthorized access to its Shopify-based online store led to the exposure of customer information, including names, contact details, shipping addresses, and order records showing what was bought and at what price. The company said the incident did not expose payment data, recovery phrases, private keys, or wallet passwords.
The breach is drawing added scrutiny because Keystone has for months promoted a policy of deleting shipping information 180 days after an order. Some customers now say data tied to purchases older than that window was included, raising questions about whether the company’s stated retention promise was fully carried out.
Breach detected in October
Keystone said it detected unauthorized access to its store on Oct. 20. Three days later, after checking API activity with Shopify, the company said it had confirmed that a third party had obtained sensitive customer information.
According to Keystone, the exposed data included customer names, contact details, shipping addresses, and order details such as purchased items and prices. The company has not said how many customers were affected, and it did not explain how the attacker gained access.
What Keystone says was and was not exposed
In its public statements, Keystone said the compromised information did not include payment data, recovery phrases, private keys, or wallet passwords. The company apologized for the incident and said it had blocked the unauthorized access, fixed the vulnerability, opened an investigation, and begun emailing affected customers.
Keystone also warned users to be cautious of follow-up scams. It said customers should not enter recovery phrases into devices they did not order and should avoid clicking links in suspicious messages claiming to be from the company.
Customers dispute data-retention claims
The incident has prompted criticism beyond the breach itself because Keystone had presented data deletion as part of its privacy approach. The company’s Privacy Promise said all shipping information is automatically deleted 180 days after an order is placed, and Keystone had promoted that practice as a selling point.
Some customers, however, reported that information linked to orders older than 180 days appeared to have been exposed. Those claims, if accurate, would conflict with Keystone’s repeated public assurances about how long shipping data is retained.
Key issue now is scope and verification
At this stage, several important details remain unresolved. Keystone has confirmed the categories of information involved and the basic timeline of the incident, but it has not provided a customer count or a fuller technical explanation of the breach path.
The next confirmed step is the company’s ongoing investigation and direct outreach to affected users. Until Keystone provides more detail, the central open question is whether older customer records were still stored despite the company’s stated policy to delete shipping information after 180 days.
Source: www.theblock.co