Keystone breach hit old orders it promised to delete

Customers of hardware wallet maker Keystone say this week's breach exposed data the company had promised to erase. Keystone has long marketed a rule that shipping details are deleted 180 days after an order, yet several buyers with much older orders say they were caught up in the leak, The Block reports. The company has not yet answered whether the policy was followed.

What Keystone has confirmed

As we reported this morning, Keystone detected unauthorised access to its website on 20 October. On 23 October, after checking API activity with Shopify, which runs its online shop, it confirmed that an outsider had obtained customer data. In a post on X on Saturday it said:

• Taken: names, contact details, shipping addresses and order details, including the items bought and their prices.
• Not taken, per Keystone: card and bank details, recovery phrases, private keys and wallet passwords.
• Still unknown: how many customers are affected, how the attacker got in and whether the attacker has been identified. A detailed report is promised "in the coming days".

The 180-day promise

Keystone has used data retention as a selling point. On 5 January, the day Ledger customers learned of a leak at its e-commerce partner Global-e, Keystone posted that shipping data is "permanently deleted" 180 days after an order. In March it wrote that other wallet makers "keep your data forever". Its Privacy Promise page repeats the 180-day rule.

The fine print is looser. Keystone's privacy policy, last updated in May 2021, says it erases order information for customers who have not ordered within the last 180 days, so a repeat buyer's older orders could legally be kept. A help-centre article adds that a customer's city and country are never deleted and that the final deletion is handled by Shopify.

What customers are saying

• One buyer wrote on X that they ordered "over two years ago" and still received a breach notice.
• Another said 214 days had passed between their last order and the breach.
• A third user said that on Friday evening, before Keystone's announcement, a caller spoofing a Montreal police number asked whether Keystone "meant anything" to them and knew details matching a 2024 order.

The Block says it could not verify these claims.

Part of a wider pattern

Keystone is the latest wallet maker to report a customer data leak this year. Trezor said in August that a breach at shipping partner ShipMonk exposed data of nearly 14,000 customers, later adding about 67,000 more in the US, and SafePal said days later that an order-tracking flaw exposed almost 40,000 customers. Earlier this month Ledger confirmed tampered devices sold by a reseller that capture recovery phrases. A hardware wallet still protects keys, but these cases show your name and address can travel far beyond the device maker.

What to do now

Assume any message or call that mentions your order could be a scam. Never type your seed phrase into anything, ignore offers of refunds or "replacement" devices, and do not set up hardware that arrived without an order. Our crypto scam checklist covers the usual scripts.