Keystone Hardware Wallet disclosed today that its website was accessed without authorization on October 20, exposing customer names, contact details, shipping addresses and order details, including items purchased and prices. The company confirmed on October 23, after verifying API activity with Shopify, that a third party obtained the information.
Keystone stated that payment card details, bank information, recovery phrases, private keys and wallet passwords were not compromised. The company has blocked access, patched the vulnerability, opened an investigation and is notifying affected customers by email. Keystone warned customers to avoid unexpected links and never disclose recovery phrases or private keys.