[DigitalToday reporter Hyunwoo Chu] Hardware wallet maker Keystone suffered a breach of its Shopify-based online store that leaked customer names, contact details, shipping addresses and order information, blockchain outlet Cryptopolitan reported on Oct. 26 local time.

Keystone detected unauthorised access on its official website on Oct. 20 and confirmed on Oct. 23, after reviewing Shopify API activity, that a third party had obtained customer shipping data. The leaked information includes customer names and contact details, addresses, and order records such as purchased items and prices. Payment information, recovery phrases, private keys and wallet passwords were not leaked, it was reported.

Keystone blocked external access and fixed vulnerabilities, and began an investigation and email notifications to affected customers. It did not disclose the number of victims, the intrusion route or information about the attacker. It plans to release a detailed report later.

The company warned of impersonation attempts exploiting the leak. It said customers could receive calls, text messages, emails or mail claiming to offer refunds, send new devices or change orders or addresses. It also urged customers not to enter recovery phrases into devices they did not order and to type website addresses directly.

Suspected cases have also emerged. One X user said they received a call impersonating a Montreal police number and claimed the caller asked whether they knew Amazon, eBay and Keystone. The user wrote that what the caller mentioned matched the user’s 2024 Keystone order details.

The incident also intersects with Keystone’s data deletion policy. Keystone said on Jan. 5 that it permanently deletes shipping data after 180 days from an order, and wrote in March that it deletes shipping information within up to 180 days. Some customers, however, claimed they received breach notifications related to orders older than 180 days.

There are also differences across Keystone’s public documents. A privacy pledge page says shipping information is automatically deleted 180 days after an order, but a privacy policy last updated in May 2021 says only order data for customers without an order in the past 180 days is deleted. A customer service document says city and country records remain even if deletion is requested, and that final deletion is handled by Shopify.

Similar incidents have continued in the hardware wallet industry. Trezor said about 14,000 people were exposed due to a breach of shipping partner ShipMonk in August, and that about 67,000 U.S. customers were additionally exposed later. SafePal also said a few days later that information on about 40,000 people was exposed due to a bug in its order tracking system. Keystone wallets sign transactions with QR codes and do not require USB, Bluetooth or Wi-Fi connections, but this incident occurred at its Shopify store.

The incident showed that sales and shipping data management can be another vulnerability point, separate from hardware wallet security. In particular, the gap between Keystone’s stated 180-day deletion policy and the actual retention scope highlighted that data governance is a core task in e-commerce integration environments.