Keystone wallet maker discloses website breach exposing customer order data
Security & Exploits ·
Keystone Hardware Wallet says a third party accessed its official website without authorization, obtaining customer shipping and order details, though private keys and payment information were not compromised.
The company detected the intrusion on October 20 and confirmed the data exposure on October 23, after reviewing API activity together with Shopify, according to a report. The exposed data included customer names, contact details, shipping addresses, purchased items, and prices tied to those orders.
Keystone said no payment card or bank details were exposed, and that recovery phrases, private keys, and wallet passwords remained secure throughout the incident, per the same report. The company stated it has since blocked the unauthorized access and fixed the underlying vulnerability that allowed the breach to occur.
Keystone is notifying affected customers directly about the exposure, and the company has posted about the incident on its official account. As part of its response, Keystone warned customers to watch for impersonation scams that may follow, including fraudulent messages offering fake refunds, replacement devices, or fixes to orders using the leaked shipping and order information.
The breach has been corroborated by at least one other source covering the incident. What remains unclear is the number of customers affected, how the unauthorized access was initially obtained, and whether any of the exposed shipping and order data has already been used in follow-on scams. Keystone has not detailed what additional security measures, if any, will be put in place beyond the described fix.