Hardware wallet maker Keystone confirmed that unauthorized parties accessed customers’ order and delivery information, warning them to beware of fake refund and device replacement messages that may be sent using this data.
According to a statement reported by Wu Blockchain, the company detected unauthorized access to its official website on October 20. After reviewing API activity with Shopify, it confirmed on October 23 that customer data had been exposed.
The accessed information includes customers’ names, contact details, delivery addresses, the products they purchased, and the prices of those products.
Fake messages may include real order details
Keystone warned customers that the leaked information could be used in messages made to look as though they were sent by the company. These messages may cite reasons such as a refund, a replacement device, or a fix for an issue with an order.
Using genuine details such as the product purchased and the delivery address may make these fake messages seem more convincing. The company’s warning indicates that senders who know order details should not automatically be considered trustworthy.
Keystone: Private keys and recovery phrases were not affected
According to the company’s statement, payment card and bank details, recovery phrases, private keys, and wallet passwords were not among the exposed data.
Keystone reported that it had blocked the unauthorized access and fixed the security vulnerability. The process of notifying customers affected by the incident is also ongoing.
Not investment advice.