Keystone Says Website Intrusion Exposed Customer Shipping and Order Data

What Keystone says was exposed

The exposure Keystone disclosed affects customer privacy and could give impersonators details for convincing scams. The hardware wallet company says an intruder accessed its website and obtained shipping and purchase records, though it hasn’t said how many people were affected or when the records were created. That uncertainty matters: without a count or a defined order period, customers can’t tell from the disclosure whether their own purchases may be involved.

Keystone detected the intrusion on Oct. 20, reviewed API activity with Shopify, which runs its online store, and confirmed the data had been taken on Oct. 23. The company disclosed the incident in an Oct. 24 post on X, writing, “We owe you an apology.” The timeline describes when Keystone found and confirmed the activity, but leaves open how long the intruder had access before detection. That distinction will matter when the company provides a fuller account.

The records may include names, contact details, shipping addresses, and order information, including products purchased and prices paid. Keystone says payment card and bank information, wallet passwords, private keys, and recovery phrases weren’t exposed. That separation is meaningful: the company says the incident did not reach information that directly unlocks a wallet or payment account. But order details can still make a message feel credible, especially if a scammer knows what a customer bought and where it was sent.

Keystone says it has blocked the access, fixed the flaw, started an investigation, and begun notifying affected customers by email. A fuller account is expected, but the company hasn’t described the entry method or the period of orders involved. Until those details are available, the public account offers a limited view of both the weakness and the number of records at risk.

Keystone’s shipping data retention claims

The breach disclosure also puts Keystone’s shipping-data practices in focus. Its privacy policy, last updated May 15, 2021, says order information is wiped after a customer goes 180 days without making another purchase, in line with Shopify’s policy. A retention period sets expectations about how long a company keeps information after a transaction; it also shapes how much historical data could be available if an account or system is accessed without authorization.

A help center article updated in February 2023 describes a customer-request process for deleting shipping data older than 180 days. Customers must confirm they have no order disputes and provide the email address used for the purchase. Keystone says requests can take two to three weeks, and that “records of the customer’s city and country will not be deleted.” The article says Shopify carries out the final deletion. This process puts some of the work on customers and leaves a defined exception for location information, details that can affect what a customer reasonably understands by “deletion.”

Keystone later made a more categorical claim in a Jan. 5 post on X responding to an alert from ZachXBT about a Ledger customer-data leak involving payment processor Global-e. “180 days after your order, your shipping data is permanently deleted,” Keystone wrote. Its Privacy Promises page also says shipping details are removed automatically 180 days after an order, while allowing customers to request deletion once their device arrives. The public descriptions differ on whether customers need to initiate deletion and which location details remain. That inconsistency deserves a clear explanation, particularly now that Keystone has disclosed unauthorized access to customer records.

Warning about follow-on scams

Keystone cautioned customers that scammers may contact them by phone, text, email, or post while posing as company representatives. Offers to arrange refunds, replace devices, or fix orders should be treated with care, the company said. The advice reflects a familiar risk after customer information is exposed: a message that includes a real purchase or delivery detail can appear more trustworthy than a generic phishing attempt.

It also told users never to disclose a recovery phrase or enter one on a device they didn’t order. That instruction is especially relevant for hardware wallet owners, since a recovery phrase can give someone access to the assets it protects. If you’re a Keystone customer, treat unsolicited requests about this incident as unverified and use contact channels you already trust. The company’s warning is practical, but it can’t substitute for a clear account of who was affected and what information each person’s record contained.

What the incident leaves unanswered

This is more significant than it looks. The company says the most sensitive wallet credentials were not exposed, yet names, addresses, contact details, and purchase histories can still support targeted impersonation. The risk comes from the combination: a scammer can use ordinary transaction information to make an urgent request sound specific and plausible.

Keystone says a detailed breach report is forthcoming. Customers will need that report to understand the affected order period, the number of people involved, how the intruder reached the records, and what changes were made after the flaw was fixed. Those are basic questions for assessing the incident’s scope. And the retention language needs to be reconciled with the process described in the help center, including what happens to city and country data.

Until then, the scale and cause of the incident remain unclear. The company has disclosed enough to establish that customer records were taken, but not enough for customers to gauge their individual exposure. A report that answers those questions would make the current warning more useful—and give customers a firmer basis for deciding what follow-up to trust. A limited disclosure, for now.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Related Listen: Why a $100M Ledger Reseller Attack Has Crypto Rethinking Self-Custody