Following the customer data leak at Keystone, user reports about older orders have called into question the hardware wallet maker’s promise to delete delivery information after 180 days.
According to The Block, some Keystone customers say they received breach notifications about purchases older than the company’s stated retention period or were contacted by people who knew their order details. User accounts have raised questions about which customers and time periods were covered by the previously confirmed data breach.
Why is the 180-day deletion promise being questioned?
In past posts and on its privacy commitments page, Keystone said that delivery information is permanently deleted 180 days after an order is placed. Its privacy policy, meanwhile, says that all order information for customers who have not placed an order in the past 180 days is deleted.
The help center also says that city and country records are not deleted and that Shopify carries out the final deletion. As a result, statements on different company pages describe different scopes for which information is removed and when.
Customers point to older orders
One user said they received an email notification despite having made a purchase more than two years earlier. Another user said 214 days had passed between their most recent order and the breach.
Another user claimed they were called from a number that appeared to belong to the Montreal police and that the person trying to scam them knew details of a Keystone order they had placed in 2024. Keystone said in response to the post that it had launched an urgent investigation.
The Block said it could not independently verify these user claims. At the time the article was published, Keystone had not publicly answered questions about whether its 180-day deletion policy had been followed.
Company preparing a detailed report
Keystone said it detected unauthorized access to its website on October 20 and confirmed on October 23, after reviewing API activity with Shopify, that customer information had been exposed. The leak includes names, contact and delivery information, as well as the products purchased and their prices.
The company said bank and card information, recovery phrases, private keys, and wallet passwords were not affected. Keystone said it had blocked access and fixed the vulnerability, emailed affected customers, and would share a detailed report in the coming days.
The company also warned against fake refund and device replacement messages, asking customers not to enter their recovery phrases into a device they did not order and not to follow links in messages that appear to come from Keystone.
Not investment advice.