Keystone hardware wallet breach exposed customer shipping data that the company claimed to delete after 180 days.
Security & Exploits ·
A data breach at Keystone, a hardware wallet provider, has exposed customer shipping information that the company had stated would be deleted within 180 days of purchase. Some customers report that personal data from orders older than that retention window appeared in the exposed dataset, creating a discrepancy between Keystone's stated data deletion policy and what users discovered following the incident.
Keystone has maintained a public position for months that it removes shipping records after 180 days, suggesting customer data would not persist beyond that period. The breach calls that commitment into question, as affected users found their information included in the exposed material despite falling outside the promised retention timeline.
It remains unclear how the breach occurred, whether Keystone has confirmed the scope of exposed records, or what remedial steps the company plans to take. The incident raises questions about data handling practices at wallet providers and the enforceability of stated retention policies.