Keystone Website Breach Exposes Customer Shipping and Order Details

Keystone disclosed a website breach that exposed customers’ contact, shipping and order details, and warned buyers about impersonation scams involving refunds, replacement devices or address problems.

The hardware-wallet maker found unauthorized access to its website on Oct. 20. After reviewing Shopify API activity, it confirmed on Oct. 23 that a third party had accessed customer records, Keystone said.

Those records included names, contact information and shipping addresses. Order details listed the products and prices. Keystone said the exposed information did not include payment card or bank account details, seed phrases, private keys or wallet passwords.

The company blocked the unauthorized access, fixed the vulnerability and began an investigation. It is contacting affected customers by email.

Keystone urged customers to be wary of impostors offering refunds or replacement devices, or claiming that an order or delivery address needs correction. Keystone makes hardware wallets; the disclosed records concerned buyers’ contact, delivery and online order information.