Keystone has confirmed a data breach affecting customers of its hardware wallets, exposing personal information but not payment details.
Keystone, a manufacturer of hardware cryptocurrency wallets, has confirmed a data breach involving customer information. The company announced that an unauthorized party accessed its online store, leading to the theft of sensitive customer data.
"We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we’re sorry we didn’t keep them safe," Keystone stated.
The breach exposed customers' names, contact information, shipping addresses, and order details, including item prices. However, Keystone reassured that payment card information, bank details, recovery phrases, private keys, and wallet passwords were not compromised.
Keystone identified the security breach on October 20 and, in collaboration with Shopify, confirmed the unauthorized access three days later. The company has since blocked access, patched the vulnerability, initiated an internal investigation, and begun notifying affected customers via email.
Despite the company's assurances, some customers have raised concerns regarding its data privacy practices. Keystone's website claims that shipping information is automatically deleted 180 days after an order is placed. However, some users reported receiving breach notifications even after this period, prompting questions about the company's compliance with its own privacy policies.
One customer expressed alarm after receiving a suspicious phone call from someone claiming to be from the Montreal police, who attempted to gather personal information related to Keystone. The caller had details that coincided with the customer’s past orders, raising further suspicions about the breach.
"I received a call from a spoofed Montreal SPVM number, and the guy tried to social-engineer me. He mentioned my order details, which made me realize something was off," the customer reported.
Keystone has initiated an urgent investigation into these claims but has not publicly addressed the specific concerns regarding the 180-day data deletion policy. The incident follows a series of data breaches in the cryptocurrency sector, including a recent leak affecting Trezor, which compromised nearly 81,000 customers' information.
A detailed report from Keystone is expected in the coming days as the company continues to address the fallout from this incident.
