The Keystone data breach exposed customer shipping and order information from the hardware wallet maker’s Shopify-powered store, raising questions about whether older records were retained despite a 180-day deletion promise.

Key Takeaways

  • Keystone said payment information, recovery phrases, private keys and wallet passwords were not compromised.
  • Some customers reported receiving notifications about orders placed more than 180 days earlier, but the age of the exposed records remains unconfirmed.

What the Keystone data breach exposed

Keystone detected unauthorized access to its website on October 20, 2026. After reviewing Shopify API activity, it confirmed on October 23 that a third party had obtained customer shipping information.

The exposed data included names, contact details, shipping addresses and order information, including products purchased and their prices. Keystone has not disclosed how many customers were affected, how the attacker gained access or how far back the compromised records extend.

The company warned customers about calls, emails, text messages or physical mail offering refunds, replacement devices or supposed fixes to orders and addresses. Genuine purchase details could make such approaches more convincing.

Deletion policy remains in question

Keystone’s Privacy Promise says shipping information is automatically deleted 180 days after an order. Its privacy policy uses different wording, saying order information is erased for customers who have not placed another order within the previous 180 days.

Several customers claim they received breach notifications even though their most recent orders were more than 180 days old. Keystone has not established whether those older records were in the compromised dataset or explained how they might have remained available. Its support material says Shopify handles final deletion, but the available information does not establish responsibility for any retention.

Next milestone

Keystone has promised an investigation report, which could clarify the scope of the exposure and the handling of older records.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.