Hardware wallet maker Keystone has disclosed a breach of its online store that exposed customer contact and shipping information, warning that criminals could use genuine purchase details to impersonate the company.
In an October 24 statement reproduced by The Block and other publications, Keystone said it detected unauthorized website access on October 20 and confirmed data theft on October 23 after reviewing API activity with Shopify.
The company listed names, contact details, shipping addresses and order information, including products and prices, among the exposed records. It said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed. The affected customer count and the period covered by the records remain undisclosed.
A store record can become a convincing pretext
The immediate concern is the relationship between an identity, an address and a hardware-wallet purchase. Someone who knows those details can make an unexpected support message sound more credible than a generic phishing email.
A message referring to the correct device or delivery address still does not establish who sent it. Nor does knowledge of an order give a caller authority to request wallet credentials. A real purchase record can be reused as the opening to an unrelated fraud.
Keystone says it has blocked the unauthorized access, corrected the vulnerability, opened an investigation and begun emailing affected customers. It warns about impostors offering refunds, replacement devices or help with orders, and against entering recovery phrases into devices the customer did not order.
The device and the storefront are separate systems
A hardware wallet's purpose is to protect the keys used to authorize crypto transactions. A retailer's shipping database serves another purpose: completing purchases and deliveries. Keeping keys offline does not automatically protect identifying information collected through that commercial relationship.
The disclosure does not establish that the signing hardware or its firmware was compromised. Equally, the absence of exposed private keys does not make the loss of home addresses inconsequential. The two kinds of information create different risks and require different responses.
Keystone's reference to examining Shopify API activity explains part of its investigation. It is not evidence that Shopify's platform itself was breached, and the available statement does not identify the intruder's entry point.
Our guide to wallet keys, backups and recovery explains why possession of recovery information carries a different consequence from knowledge of a retail purchase.
Deletion promises leave questions for the investigation
Keystone's public privacy materials make data retention part of its customer proposition. Its privacy policy describes erasing order information when a customer has not ordered within the preceding 180 days. The wording makes the customer's recent purchase history relevant to the stated retention period.
A period measured from the most recent purchase can differ from one measured separately for each order. The support FAQ also says that city and country records remain and describes Shopify's role in completing deletion requests. Establishing which records were held, under which policy and for how long requires more than assuming that every reference to 180 days means the same thing.
Some customers have alleged that older purchases were included in the exposure. Those accounts have not been independently verified here. Keystone's promised detailed report will need to clarify the scope, retention practices and method of access before firm conclusions can be drawn.