AnswersPublished21 sources
Keystone Data Breach: Customer Data Exposed, but Key Questions Remain
Keystone detected unauthorized access on October 20, confirmed customer data exposure on October 23 after reviewing Shopify API activity, and disclosed the breach on October 24, 2026. Customers reported that some exposed orders may be older than Keystone’s advertised 180 day deletion window, but those reports have n...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Keystone detected unauthorized access on October 20, confirmed customer data exposure on October 23 after reviewing Shopify API activity, and disclosed the breach on October 24, 2026.
- Customers reported that some exposed orders may be older than Keystone’s advertised 180 day deletion window, but those reports have not been independently verified and the company has not publicly confirmed whether it...
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is known about cryptocurrency hardware-wallet maker Keystone’s customer-data breach, including its October 20 detection, October 23 con. Article summary: Keystone disclosed a breach of its online-store customer data on October 24, 2026, after detecting unauthorized access on October 20 and confirming exposure on October 23 through checks of Shopify API activity.[5][9] The. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
Keystone disclosed a breach of its online-store customer data on October 24, 2026. The company said it detected unauthorized access on October 20 and confirmed on October 23, after reviewing Shopify API activity, that a third party had obtained customer information.5
6
9 The incident exposed personal and purchase details, not—according to Keystone—payment data or wallet credentials. How many people were affected and how the attacker gained access remain unknown.
What information was exposed?
The exposed records included customer names, email addresses, phone numbers, shipping addresses and order details, including the items purchased and their prices.5
6 Keystone said payment-card and bank details, wallet passwords, recovery phrases and private keys were not exposed.
5
6
That distinction matters: the reported breach involved customer records held through the online store, not a reported compromise of customers’ wallet secrets. The information exposed can still make scams more convincing because an attacker may be able to refer to a real purchase or delivery address.5
11
What Keystone has said about its response
Keystone apologized to customers and said it blocked the unauthorized access, fixed vulnerabilities, began an investigation and contacted affected customers by email.9
15 The company also said it would provide a more detailed report, but the reporting available here does not include that report.
12
15
Keystone has not disclosed the number of affected customers, the precise attack method or how long the attacker had access. October 20 is the date the company detected unauthorized access; it does not establish when the intrusion began.7
12
Shopify API activity was part of Keystone’s review, and the store is described as Shopify-powered.5
6 That connection does not, by itself, show that Shopify’s underlying platform was breached. The available reporting does not establish that Shopify’s platform was the source of the unauthorized access.
Why the 180-day deletion policy is in question
Keystone has advertised that shipping information is permanently deleted 180 days after an order. Its privacy policy, however, describes deleting order information for customers who have not placed an order in the preceding 180 days.1 Those statements are not the same: the policy wording makes deletion dependent on a period without another order, rather than simply 180 days after each purchase.
Reports identify the privacy policy as last updated in May 2021.15 Customers have said they received breach notices tied to orders older than 180 days, including orders more than two years old.
1
7 Those reports have not been independently verified, and Keystone had not publicly confirmed whether it complied with its deletion policy.
1
5
The reporting supports a discrepancy between the advertised deletion promise and the policy wording, as well as customer allegations about older records. It does not establish that Keystone definitively violated its policy.
What customers should watch for
Keystone warned customers not to share recovery phrases with anyone claiming to represent the company.11
12 Treat unexpected messages about refunds, replacement devices, wallet recovery or order corrections with caution—especially if they ask for a recovery phrase, password or payment.
Because exposed records include contact and delivery information, scammers may be able to make impersonation attempts feel more credible. Security researcher Taylor Monahan also warned that shipping-address exposure could create physical-security risks, including robbery or kidnapping. That is a warning about potential risk, not evidence that such attacks have happened to Keystone customers.7
11
If a message seems connected to the breach, avoid using its links or contact details. Seek help through a contact method you verify independently, and never disclose a recovery phrase.
How Keystone compares with other reported wallet-maker data leaks
The available reporting gives a clearer numerical picture for Trezor and SafePal than for Keystone. Trezor initially reported 13,689 customers affected by a breach at shipping provider ShipMonk, then identified approximately 67,000 additional U.S. customers. Those figures amount to roughly 80,689 customers reported across the two updates.38 Trezor warned that exposed data could increase the risk of phishing and other scams.
38
SafePal’s exposure was linked to an order-tracking component, and reporting put the number of affected customers at about 39,798.35
37 Keystone has not disclosed its affected-customer count, so a numerical ranking against those incidents is not possible.
5
12
The supplied reporting does not provide enough verifiable detail to compare Keystone with Ledger’s 2020 incident by affected-customer count or subsequent scam activity. That comparison should not be filled in with figures from Ledger’s separate, later incident.
Across the reported cases, the core concern is customer information that can help make scams more targeted. In Keystone’s case, the reported exposure is serious even though the company says payment data and wallet credentials were not compromised.5
6
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Keystone Data Breach: Customer Data Exposed, but Key Questions Remain"?
Keystone detected unauthorized access on October 20, confirmed customer data exposure on October 23 after reviewing Shopify API activity, and disclosed the breach on October 24, 2026.
What are the key points to validate first?
Keystone detected unauthorized access on October 20, confirmed customer data exposure on October 23 after reviewing Shopify API activity, and disclosed the breach on October 24, 2026. Customers reported that some exposed orders may be older than Keystone’s advertised 180 day deletion window, but those reports have not been independently verified and the company has not publicly confirmed whether it...
Sources
theblock.coKeystone customers say breach exposed data the hardware wallet maker promised to delete
cryptonews.netKeystone Hardware Wallet says website breach exposed ...
thetokenpress.comKeystone Website Breach Exposes Customer Shipping Data
cryptoticker.ioKeystone data breach: customer addresses exposed