Keystone is warning customers that an intruder got into its official website and took their shipping information, the company said in an Oct. 24 post on X.
Keystone said it detected the intrusion on Oct. 20 and, after checking API activity with Shopify, the e-commerce platform behind its store, confirmed on Oct. 23 that the data had been taken. “We owe you an apology,” the company wrote.
According to Keystone, the exposed records include customers’ names, contact details, shipping addresses and order details, covering the items bought and the prices paid. The company said payment card and bank details, recovery phrases, private keys and wallet passwords were not part of the exposure.
Keystone said it has cut off the access, patched the flaw, opened an investigation and begun emailing affected customers. Its post did not say how many customers were affected, how the intruder got in, or what range of order dates the data covered.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What Keystone Says About Data Retention
Keystone has described its handling of shipping data in several places over the years. The earliest is the company’s privacy policy, last updated May 15, 2021. It says Keystone wipes order information for any customer who has gone 180 days without placing an order, and that its retention practice follows Shopify’s policy.
A Keystone help center article, updated in February 2023, presents deletion of shipping data older than 180 days as something customers must request, confirming they have no order disputes and supplying the email address used for the order, a process it says can take two to three weeks. The article says “records of the customer’s city and country will not be deleted,” and that Shopify performs the final deletion.
In a Jan. 5 post on X, which quoted ZachXBT’s alert about a Ledger customer-data leak through payment processor Global-e, Keystone wrote that “180 days after your order, your shipping data is permanently deleted.”
Its Privacy Promises page likewise says shipping details are removed automatically 180 days after an order is placed, and that buyers can ask for deletion as soon as their device arrives.
Keystone Warns of Impersonators
The company warned that scammers could pose as Keystone by phone, text, email or post, offering refunds, replacement devices or order fixes. It told users never to share a recovery phrase or type one into a device they did not order.
Keystone said a detailed report on the breach is coming soon.
Related Listen: Is an iPhone a Better Hardware Wallet Than a Ledger? – Uneasy Money
The post Keystone Says Intruder Took Customer Names and Addresses From Its Website appeared first on Unchained.