Keystone breach exposes customer order data, raises questions over deletion policy
A data breach at hardware wallet maker Keystone is raising concerns about how long customer information remains in its systems after purchases. Customers say the incident may have exposed details tied to orders older than the 180-day retention period the company has said it follows.
Highlights
- Keystone confirmed on Oct. 23 that an attacker accessed its Shopify store, compromising customer names, contact info, addresses, and order details but not payment data, recovery phrases, or private keys.
- Customers reported breach notifications despite making purchases over 180 days ago, challenging Keystone's data deletion policy and raising questions about its retention practices.
- Exposed customer data increases phishing risks in the crypto sector, prompting Keystone to warn users of scammers impersonating the company following the security incident.
Breach timeline and disputed data retention
As reported by The Block, Keystone says an attacker accessed its Shopify-based store and obtained customer names, contact details, shipping addresses and order details. The company says no payment data, recovery phrases or private keys were exposed, but it has not disclosed how many customers were affected.Keystone says it detected unauthorized access to its official website on Oct. 20. Three days later, after reviewing API activity with Shopify, which powers its online store, the company says it confirmed that an unidentified third party had obtained sensitive customer information.
In a message to customers, Keystone says it is sorry for failing to protect the information entrusted to it. The company has for months said it deletes shipping data 180 days after an order, but customer accounts on social media are now calling that policy into question.
Security risks for crypto wallet users
Several customers say they received breach notifications even though they bought Keystone wallets well over 180 days ago. If confirmed, those claims could increase scrutiny of the company's data handling practices and retention controls.Keystone confirmed the breach on Oct. 23 and says it is conducting an investigation. The company is also warning customers to watch for scammers posing as Keystone, a notable risk in the crypto sector where exposed contact and order data can be used in targeted phishing attempts.
Our earlier article on CTOS Digital’s cybersecurity incident examined the estimated business impact from the breach, including a projected drop in profit and revenue if service disruptions persisted into late October. We also noted that extended downtime could further pressure earnings and customer confidence, even as some analysts maintained a relatively constructive view at the time.