# Crypto Wallet Maker Admits Customer Data Meant to Be Deleted Remained in Its System

> Hardware wallet maker Keystone admitted it failed to delete customer data on time, saying some records exposed in the attack remained in its system because of an unnoticed failure in…

**[Hardware wallet](https://koinbulteni.com/en/guides/hardware-wallet-setup-guide) maker Keystone admitted it failed to delete customer data on time, saying some records exposed in the attack remained in its system because of an unnoticed failure in its automated deletion tool.**

According to a company statement reported by CoinDesk, an attacker accessed Keystone’s website on **October 20 through a vulnerability in a third-party data monitoring tool**. The breach affected 25.964 recipient records from the 2024–2026 period, exposing names, contact information, delivery addresses, and order details. The company also said 12.873 unpaid order records may have been affected.

### The 180-Day Deletion Promise Was Not Kept

Keystone’s existing policy called for customer records to be **deleted after 180 days**. However, the automated tool responsible for the process failed, and the company did not notice the problem. As a result, some data that should have been removed was still in the system at the time of the attack.

The company accepted responsibility, acknowledging that it failed to meet its commitment to delete customer data on time. Going forward, it plans to **reduce the data retention period to 90 days**.

This statement reveals the company’s response to [claims about old order records that should have been deleted](https://koinbulteni.com/en/crypto-wallet-maker-said-it-would-delete-data-users-report-orders-more-than-two-years-old-290920.html), which we reported earlier.

### Verification Warning for Wallet Users

The same attack also compromised a key used to verify devices’ authenticity online. For this reason, Keystone had announced that it would [destroy 18.835 unsold devices](https://koinbulteni.com/en/crypto-wallet-maker-to-destroy-thousands-of-devices-counterfeits-could-pass-verification-290994.html). The company says users’ recovery phrases, private keys, and wallet login credentials were not exposed.

According to Keystone, devices delivered before October 20 can continue to be used if they pass the authenticity check. Customers who received devices after that date that use the old verification key should contact the company for an additional check before using them.

The company also said there is no need to move funds solely because of this breach and warned users about **fake device recall and asset transfer messages**. The verification key will be changed on new devices, and sales through the website will also switch to a preorder model.