Keystone Breach Exposes Customer Addresses and Order Details

Hardware-wallet manufacturer Keystone identified unauthorized activity on its website on October 20, later classifying it as a security breach. The incident compromised customer names, phone and email contacts, shipping destinations, and purchase histories. Following an API activity audit conducted alongside Shopify, the firm verified the data leak on October 23.

The compromised purchase logs revealed specific items bought and the corresponding amounts paid. Although Keystone intercepted the unauthorized access, patched the security flaw, and initiated outreach to impacted buyers, it refrained from disclosing the total count of affected individuals.

Customer records were exposed, not wallet credentials, Keystone says

According to Keystone, the security event did not compromise credit card data, banking credentials, wallet passwords, recovery seeds, or private keys. The unauthorized parties gained entry strictly to customer commerce records, and the organization stated that none of its physical wallet units were breached.

“You trusted us with those details, and we’re sorry we didn’t keep them safe,” Keystone said in its apology to customers.

Red Flags: Shipping and order data could help scammers impersonate Keystone

The leaked files provide fraudsters with details useful for convincing impersonation campaigns. Keystone cautioned that buyers might receive fraudulent phone calls, text messages, emails, or physical letters promoting refunds, replacement hardware, or supposed corrections to deliveries and shipping locations. Communications incorporating a buyer’s actual name or order specifics can appear authentic even if they originate outside the company.

Dogecoin community member Mishaboar cautioned that delivery logs could likewise enable fraudsters to execute targeted phishing campaigns. Purchasing a physical crypto-wallet does not confirm that an individual currently owns digital assets, but it supplies bad actors with a tailored premise for outreach.

In a warning on X, Mishaboar urged customers not to reveal more information about themselves or their families on social media. Citing earlier incidents involving Trezor and Ledger, he said scammers could also approach victims through physical mail.

Keystone told customers never to share recovery phrases or private keys, enter a recovery phrase into a device they did not order, or click links in unexpected messages. The company said it will never ask for recovery phrases or private keys.

Keystone’s 180-day data-retention policy faces questions

Keystone has maintained that it purges consumer data 180 days post-order under standard operating conditions. In the wake of the breach, users on X challenged the validity of this assertion.

The incident has put fresh scrutiny on how long the company keeps purchase and shipping records accessible.

Earlier incidents affected Trezor customer records and Ledger distribution

Earlier in the summer, a breach at Trezor logistics provider ShipMonk exposed names, emails, phone numbers, shipping addresses and order information. Trezor initially said more than 13,000 US customers were affected, but later disclosures pushed the total above 80,000, according to CryptoPotato.

Ledger disclosed a different type of attack earlier in October. Genuine devices sold through some Southeast Asian resellers had been fitted with hidden hardware capable of reading the 24-word recovery phrase during initial setup and transmitting it over an LTE connection. Ledger said its Secure Element, operating system and internal servers were not compromised, describing the incident as a localized distribution-channel attack. Initial reports connected the devices to more than $86 million in suspected thefts, though Ledger had not confirmed that figure.

Company begins customer outreach and investigation

Keystone is currently emailing impacted users while the security review continues. The firm indicated that a comprehensive report will be published eventually, though no timeline was provided.

?FAQ

01When did Keystone detect the website access and confirm the exposure?

Keystone said it detected the unauthorized access on October 20, 2026. After reviewing API activity with Shopify, it confirmed on October 23 that customer shipping information had been obtained.

02What customer information was exposed?

The exposed records contained customer names, contact details, shipping addresses, order information, products purchased and prices paid. Keystone said the breach did not expose payment-card information, bank details, wallet passwords, recovery phrases or private keys.

03What should customers do if a message offers a refund or replacement?

Keystone warned that scammers may use refund or replacement offers to impersonate the company. Customers should avoid links in unexpected messages, use official channels and refuse to share sensitive information.

04What does Keystone’s 180-day deletion statement cover?

Keystone has said it deletes customer information 180 days after orders in most cases. Users on X questioned that claim after the company disclosed the breach.

05What happens after Keystone contacts affected customers?

The company says it is emailing affected customers and has opened an investigation. It has promised a fuller report but has not specified when it will publish it.

This article is for information only and is not financial advice.