Keystone Asks Shopify to Erase Data After Website Breach

Keystone has asked Shopify to erase data associated with its online store and notified regulators in the European Union, United Kingdom and elsewhere as the hardware-wallet maker responds to a breach involving customer records and a device key.

Keystone said the incident exposed 25,964 buyer records with names, contact details, delivery addresses and purchase information from 2024 to 2026. It also said 12,873 incomplete checkout records were exposed. The company detected the breach on Oct. 20.

Keystone said the attacker obtained WebAuth, an authentication key written into devices during manufacturing and used to verify they are genuine. The company said the key cannot be erased or changed once installed. It assessed that the exposed key could let counterfeit devices pass authenticity checks, potentially putting users’ assets at risk.

Keystone’s response also includes pausing unshipped orders and destroying 18,835 unsold devices that contain the key. It plans to take preorders for devices made with a replacement key, as outlined in earlier coverage of the compromised authentication key. The company has shortened its data-retention period from 180 days to 90 days.

Keystone said the exposed information did not include recovery phrases, private keys or payment information. It also said devices shipped before Oct. 20 remain valid if they pass authentication.