Keystone Data Breach Tests 180-Day Deletion Promise
Hardware wallet maker Keystone has disclosed a customer-data breach involving its Shopify-powered online store, exposing names, contact details, shipping addresses and order information while leaving payment details and wallet credentials unaffected.
Keystone said it detected unauthorized access to its website on October 20 and confirmed on October 23, after reviewing Shopify API activity, that a third party had obtained customer shipping information. The company has not disclosed how many customers were affected, how the attacker gained access or how far back the compromised records extend.
The more difficult question now concerns data Keystone said should no longer have existed. Several customers claim they received breach notifications despite placing their most recent orders more than 180 days earlier, potentially conflicting with Keystone’s public promise that shipping information is automatically deleted after that period.
What Information Did the Keystone Attacker Obtain?
Keystone said the exposed information included customer names, contact details, shipping addresses and order details, including products purchased and their prices.
Payment-card information and bank details were not exposed, according to the company. More importantly for wallet security, Keystone said recovery phrases, private keys and wallet passwords were not compromised.
That distinction means the incident does not currently indicate that Keystone’s hardware wallets or their cryptographic protections were breached. Instead, the immediate threat comes from attackers using genuine customer information to make phishing, impersonation or social-engineering attempts more convincing.
Keystone specifically warned customers about calls, emails, text messages or physical mail offering refunds, replacement devices or supposed fixes to orders and addresses. A scammer who already knows which hardware wallet a customer purchased and where it was delivered has considerably more information with which to establish credibility.
Hardware-wallet customers have faced the same problem before. Earlier this year, Ledger disclosed customer information exposure through e-commerce partner Global-e, while subsequent phishing campaigns demonstrated how leaked identity and address information can remain useful to attackers even when private keys themselves were never compromised.
Investor Takeaway
The breach did not expose wallet keys, but customer addresses and purchase histories can turn an ordinary data leak into a targeted social-engineering and physical-security risk.
Did Keystone Delete Shipping Data After 180 Days?
Keystone has repeatedly promoted limited data retention as part of its privacy positioning. Its Privacy Promise states that shipping information is automatically deleted 180 days after an order is placed.
Its privacy policy uses slightly different language, saying order information is erased for customers who have not made another order within the previous 180 days. Keystone’s support material also says city and country records may remain and that final deletion is handled through Shopify.
The difference matters because several customers now claim older information was still available when the breach occurred. One user said an order placed more than two years earlier was affected, while another said 214 days had passed since their latest purchase.
A separate customer alleged that a caller posing as police possessed details matching a Keystone order from 2024. That account has not been independently verified, and the available evidence does not establish that the caller obtained the information through this breach.
Keystone has not yet publicly established whether those older records were present in the compromised dataset or explained how they could have remained available despite its deletion promises.
Why Does Data Retention Matter for Hardware Wallet Buyers?
Keystone’s problem resembles a recent dispute involving Trezor and its fulfillment provider ShipMonk. In September, Trezor said another 67,000 U.S. customers had been exposed through the ShipMonk breach, including people whose purchases dated back several years.
Trezor said ShipMonk had previously provided written assurances that the relevant information had been deleted. That incident demonstrated that a privacy commitment is only as effective as the systems and outside providers implementing it.
Keystone’s current disclosures create a similar question. Its online store relies on Shopify, and its own support documentation says Shopify handles the final deletion process. That does not establish whether Shopify failed to delete data, whether Keystone retained another copy, or whether the affected records fall outside the company’s stated deletion policy.
Until Keystone publishes its promised investigation report, assigning responsibility would be premature.
Investor Takeaway
The unresolved issue is not only how the attacker entered the store, but whether Keystone can demonstrate that its advertised data-retention controls were actually operating as customers were told.
What Should Keystone’s Investigation Clarify?
The company’s detailed report will need to establish the number of customers affected, the oldest compromised order, the duration and technical route of the unauthorized access, and which systems held the exposed information.
It will also need to reconcile the breach with Keystone’s 180-day privacy promise. If customers whose orders were substantially older than six months were affected, the company will need to explain why their information remained accessible and whether its deletion process operated differently from its public description.
The consequences extend beyond unwanted emails. Hardware-wallet users have already been targeted through increasingly personalized attacks. FinanceFeeds recently reported that attackers used Trezor’s genuine email infrastructure to distribute a fake security warning, while earlier campaigns used physical letters containing convincing company branding and customer information.
Keystone has so far established that the breach affected customer and order data rather than recovery phrases or private keys. What remains unresolved is whether the exposed records also reveal a failure of the privacy control the company had specifically promoted as protection against this type of incident.