Keystone Says Website Breach Exposed Customer Order Data

Keystone said unauthorized access to its website exposed customer names, contact and shipping details, and purchase records, while payment information and wallet credentials were not compromised. The hardware wallet maker said it blocked the access, fixed an identified vulnerability and began notifying affected customers by email. In a disclosure dated October 24, Keystone said it detected unauthorized website access on October 20 and confirmed on October 23 that customer information had been obtained. The company said it confirmed the theft after reviewing activity involving Shopify’s application programming interface. That review does not establish that Shopify’s platform was compromised. The exposed records included names, contact details, shipping addresses, products ordered and prices, according to Keystone. The company said payment card and bank details, passwords, private keys and recovery phrases were not exposed. The incident involved information associated with hardware wallet purchases, not reported access to credentials stored in the wallets. Keystone said it opened an investigation after confirming that an unauthorized party had obtained customer order...