Keystone Wallet discloses breach of customer shipping data
Security & Exploits ·
Keystone Wallet confirmed that a third party accessed customer order and shipping information after unauthorized entry into its official website on October 20.
The company said it first detected unauthorized access to its website on October 20 and, after verifying API activity with Shopify, confirmed on October 23 that a third party had obtained customer shipping information, according to a statement posted on X. The exposed data includes names, contact details, shipping addresses, and order details such as items and prices.
Keystone Wallet said payment card or bank details, recovery phrases, private keys, and wallet passwords were not exposed, a point also noted in coverage of the incident. The company stated it has since blocked access, fixed the vulnerability, opened an investigation, and is emailing affected customers directly.
The disclosure includes a warning that scammers may try to exploit the breach by posing as Keystone through phone calls, texts, emails, or mail, offering refunds, replacement devices, or fixes related to orders or addresses. Keystone said none of those communications originate from the company and reiterated that it will never ask customers for a recovery phrase or private keys, and that such information should never be entered into a device that was not purchased directly.
Keystone directed customers to rely only on official channels, to type its website address directly rather than clicking links in unexpected messages, and to contact its support email if anything appears suspicious. The company said a detailed report on the incident is forthcoming.
What remains unresolved is the scope of the breach, including how many customers were affected and how the unauthorized access was initially gained. The promised detailed report has not yet been published, and no timeline for its release has been given.