Keystone data breach exposes buyers' names and addresses

Hardware wallet maker Keystone said in an Oct. 24, 2026, post on X that a third party obtained customer names, contact details, shipping addresses and order details, including items and prices, from its website. The post lists recovery phrases, private keys, wallet passwords and payment card or bank details as not exposed.

Keystone's privacy policy, last updated July 7, 2026, lets you ask for earlier deletion of your order data by emailing support@keyst.one. Its support FAQ says a request to delete shipping information may take around two to three weeks.

If your order is in the records, the leak ties your name and shipping address to a hardware wallet purchase. The secret that spends your coins is the recovery phrase, a list of words that can restore a wallet. Keystone's privacy policy describes its wallets as fully offline products through which the company cannot and does not collect information. The post warns of the next risk: scammers posing as Keystone by phone, text, email or mail, offering refunds, replacement devices or fixes for an order or address.

You can ask Keystone to delete your order data

The privacy policy asks for your order number, your order email and a clear statement that you will have no dispute regarding the order. Under the support FAQ, a deletion removes your name, email address, phone number and billing and shipping addresses, while records of your city and country stay on file. The policy is issued by Yanssie HK Limited and its affiliated companies and governed by Hong Kong law.

Keystone will never ask for your recovery phrase

Keystone's Oct. 24 post sets two rules: never share your recovery phrase or private keys, and never enter a recovery phrase into a device you did not order. None of the refunds, replacement devices or order fixes scammers offer comes from Keystone, and the company will never ask for your phrase or keys.

Ledger, another hardware wallet maker, said on July 29, 2020, that an unauthorized third party had accessed part of its e-commerce and marketing database on June 25.

On Dec. 21, 2020, Ledger's CEO said many customers had been targeted by email and SMS phishing campaigns. Some had raised concerns about physical attacks because their shipping addresses had leaked.

Ledger's July 2020 log review had identified 9,532 sets of detailed customer information. The Dec. 21 statement put a leaked dump at about 272,000, with details such as postal addresses, names and phone numbers. Ledger believed the dump came from its June 2020 e-commerce database. That is about 28 times the first count (272,000 divided by 9,532), a ratio from Ledger's case alone.

Keystone's documents word the 180-day rule differently

Under Keystone's current privacy policy, the company erases all order information of each customer who has not placed an order within the last 180 days. In that wording, the clock runs from your most recent order. An older version, last updated May 15, 2021, carries the same sentence and was still online at a legacy keyst.one address as of Oct. 26, 2026.

Under the same policy, retention of order information, including name, billing and shipping addresses, email address and phone number, aligns with the policy of Shopify, which powers Keystone's online store. The support FAQ says Keystone's legal and tax advisers confirmed the company can delete shipping information older than 180 days. A request there means confirming you have no order disputes, such as refund requests, and giving your order email.

Unchained reported two more versions, both counting from each order. One is a Jan. 5 Keystone post on X saying shipping data is permanently deleted 180 days after an order. The other is a Privacy Promises page with automatic removal of shipping details 180 days after an order and deletion on request once your device arrives.

Keystone's report is the step to watch

Keystone's post dates the detection of unauthorized access to its official website to Oct. 20. The company confirmed the exposure on Oct. 23, after verifying API activity with Shopify. Keystone said it blocked the access, fixed the vulnerability, opened an investigation and was emailing affected customers. It promised a detailed report soon, with no date set.

Four points remain open after the Oct. 24 post: how many buyers are affected, which order dates the records cover, how the intruder got in and what the fixed vulnerability was. The promised report is the step to watch for the answers.