Keystone says website breach exposed hardware wallet buyers’ addresses

Keystone detected suspicious activity earlier in the week and confirmed Friday, after reviewing API activity with Shopify, that an unauthorized third party had accessed customer shipping information. This included names, contact details, shipping addresses and other order details, such as items bought.

The company stated it has blocked access, fixed the vulnerability, opened an investigation, and is emailing affected customers. However, Keystone did not disclose how many customers were impacted by the breach.

Physical attack concerns

Keystone warned that the exposed information could be used for targeted phishing attacks. Security researcher Taylor Monahan raised additional concerns that leaking shipping addresses could expose customers to physical attacks and kidnappings.

Data retention questions

The breach has raised questions about Keystone's handling of older customer information. In a 2023 blog post, Keystone said it had reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers.

Some customers reported receiving breach notifications despite purchasing their devices more than two years ago, suggesting older order records may not have been deleted as promised. One customer received a scam call referencing their 2024 Keystone order.