Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Summary
Keystone says an attacker who exploited a vulnerability in a third-party website monitoring tool stole customer information and the device-authentication key. The key could let counterfeit wallets pass authenticity checks. Keystone will destroy 18,835 devices containing it and has halted shipments until new-key devices are produced. The company considers devices delivered before the Oct. 20 breach safe, but cannot verify those delivered afterward and advises affected customers to contact support. The attacker also stole 25,964 buyer records and 12,873 checkout records retained by Shopify. Keystone attributed some data retention to failures in its deletion tool and has asked Shopify to remove older checkout information.
