Keystone website breach exposes customer shipping data

No funds. Exposed per Keystone: 'names, contact details, shipping addresses, and order details (items and prices).' Not exposed: 'payment card or bank details, recovery phrases, private keys, or wallet passwords.' Number of affected customers not stated.

Root cause: Not yet published. Per Keystone: 'unauthorized access to our official website'; confirmed 'after verifying API activity with Shopify'. Specific vulnerability not published; detailed report promised.

Timeline, as sourced: Access detected 20 Oct 2026; confirmed 23 Oct; announced 24 Oct 2026 17:59 UTC (per Keystone).

Hardware-wallet maker Keystone said on 24 October 2026 (opens in a new tab) that it detected unauthorized access to its official website on 20 October and, after verifying API activity with Shopify, confirmed on 23 October that a third party had obtained customer shipping information. According to Keystone, the exposed data covers names, contact details, shipping addresses and order details, including items and prices. It says payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed. Keystone says it has blocked the access, fixed the vulnerability and is emailing affected customers; it has not said how many. It warns that scammers may pose as Keystone by phone, text, email or mail offering refunds, replacement devices or order fixes. A detailed report is pending. Never enter a recovery phrase into a device you did not order.