Keystone Says Data Breach Exposed Customer Addresses, Purchase Histories - bloomingbit

The company discovered abnormal access to its website on October 20 and later found that a third party had exfiltrated data through its Shopify application programming interface on October 23. Keystone immediately blocked the access route and fixed the security vulnerability.

Exposed Information

The breach affected customers' names, contact details, shipping addresses, purchased products and pricing information. However, payment card and bank account information, wallet recovery phrases, private keys and passwords were not compromised, according to Keystone.

Industry Pattern

This incident follows a series of data leaks in the hardware wallet industry. In August, Trezor reported a breach affecting 14,000 customers later expanded to 67,000 US users. SafePal also experienced a flaw exposing personal data of about 40,000 users.

Policy Questions

The breach raised questions about Keystone's data retention policy, which claims to permanently delete shipping information 180 days after purchase. Some users received notifications despite making purchases over two years earlier, though these claims haven't been independently verified.