Overview
- Keystone detected unauthorized access to its website on Oct. 20 and disclosed on Oct. 26 that attackers stole a WebAuth device-authentication key and exposed 25,964 customer records.
- Exposed data included names, emails, phone numbers, shipping addresses and order details while the company says private keys, recovery phrases, wallet passwords and payment card data were not accessed.
- As a precaution Keystone will destroy 18,835 devices that contain the compromised key, stop outgoing shipments, switch to preorder-only sales and replace the stolen WebAuth key in new production.
- The company has shortened its customer-data retention policy to 90 days, submitted deletion requests to Shopify that carry a 10-day finalization period, and notified regulators and law enforcement while it continues a forensic probe.
- Security experts warn leaked shipping data raises heightened phishing and physical-attack risks for buyers and the incident adds to a 2026 pattern of hardware-wallet order and fulfillment breaches at other vendors.