Keystone says website breach exposed hardware wallet buyers’ addresses
Keystone disclosed that an attacker accessed customer shipping and order information through its website, including names, contact details, addresses and purchased items. The company says it blocked access, fixed the vulnerability, launched an investigation and is notifying affected customers, but has not said how many were impacted. The exposed data could enable targeted phishing and, according to a security researcher, increase risks of physical attacks against crypto holders. Customers who bought devices more than two years ago said they received breach notifications, raising questions about Keystone’s 2023 promise to delete customer data after 180 days. Keystone had not responded to questions about older records or the breach’s scale by publication time.
