Keystone, a manufacturer of hardware crypto wallets, confirmed a data breach involving its online store. Unauthorized access was detected on October 20, and the company verified the incident on October 23 after reviewing API activity with Shopify.
The exposed information includes customer names, contact details, shipping addresses, and order specifics such as items and prices. Keystone stated that private keys, recovery phrases, wallet passwords, and banking information remain secure.
The company has blocked the unauthorized access, patched the vulnerability, and launched an internal investigation. Affected customers are being notified via email. A detailed report is expected to be released soon.
Users have raised concerns regarding Keystone's privacy policy, which states that shipping data is deleted 180 days after an order. Some customers reported receiving breach notifications despite having placed orders more than 180 days prior to the incident.
Keystone's updated privacy policy indicates that data is retained for 180 days following the most recent purchase, rather than from each individual order. The company has not yet publicly addressed the specific discrepancies regarding data retention timelines.
