Keystone Breach Exposes Customers’ Shipping Data

Keystone disclosed a breach of its website that exposed customers’ names, contact details, shipping addresses and order information, including purchased items and prices. The company reported that payment and bank details, recovery phrases, private keys and wallet passwords were not accessed.

Keystone detected unauthorized activity on October 20 and confirmed the exposure on October 23 after reviewing API activity with Shopify, the platform used for its online store. The company disclosed the incident on October 24, blocked the access, fixed the vulnerability and began contacting affected customers.

Keystone has not provided the number of affected customers, the length of the unauthorized access or details of how the attacker entered the system. The company is investigating and plans to publish a detailed report.

The exposed information could support impersonation attempts. A scammer could use a customer’s name, delivery address and order details to send a message about a refund, replacement device or order correction. Keystone warned that it will not ask customers for recovery phrases or private keys.

“NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn’t order,” the company wrote. “We will never ask for them.”

Keystone advised customers to ignore unexpected links and type keyst.one directly into their browsers instead of following links in emails or text messages. It urged customers to treat unsolicited messages about refunds, replacement devices or delivery addresses as suspicious.

Hardware wallets store cryptocurrency signing keys offline and require confirmation on the physical device for transactions. According to Keystone, the incident did not affect that part of its products, but it exposed commercial records related to device purchases.

The disclosure follows earlier security incidents involving hardware wallet companies. Ledger reported in 2020 that a Shopify-related data leak exposed customer contact and shipping information and led to phishing attempts. Ledger has also disclosed an unauthorized hardware implant, while Trezor reduced its authorized reseller network over supply-chain concerns.

Keystone described the incident as a storefront data breach rather than a compromise of its wallet devices. Its planned report is expected to provide more information about the number of affected customers, the scope of access and the measures taken to prevent another incident.