Hardware wallet maker Keystone has confirmed a breach of its website that exposed customer shipping information, including names, contact details, home addresses and order details. The company said it detected unauthorised access to its official website on 20 October, and after reviewing application programming interface activity with its online store provider Shopify, confirmed on 23 October that a third party had obtained the shipping records. It disclosed the incident publicly on 24 October.

The exposed records cover the items customers bought and the prices they paid, as well as their contact and delivery details. That combination matters because it lets a scammer approach a named buyer, refer to a real purchase, and sound convincing. Keystone has warned customers to expect impersonation attempts by phone, text, email or post offering refunds, replacement devices or fixes linked to their orders.

What was not taken

Crucially, the breach did not reach the parts of its system that control customers' cryptocurrency. Payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed, according to Keystone. The devices themselves were not compromised, and the stolen shipping data alone cannot move funds from a device, provided the owner's recovery phrase stays private.

The social-engineering risk

The risk now is social rather than technical. After a similar leak at rival maker Ledger in 2020, criminals mailed altered replacement devices to customers in an attempt to steal their recovery phrases. Keystone says it will never ask for a recovery phrase, and any unsolicited device should not be set up or used. Customers should treat unexpected messages about their order as suspect until verified through Keystone's official website, and should never type a recovery phrase into a website, app or device they did not set up themselves. Keystone has not said how many customers were affected or who was behind the intrusion.

Sources: CryptoAdventure; MyToken.