Keystone confirmed a security breach involving unauthorized access to its official website and customer shipping data. The attacker obtained the WebAuth key used to verify device authenticity, prompting the company to suspend shipping and destroy nearly 19,000 unshipped hardware wallets.
The incident exposed personal information for approximately 26,000 records, including names and addresses, though payment details and wallet keys remained secure. Keystone acknowledged that its automated data deletion tool failed to operate reliably, resulting in the retention of personal information beyond its stated policy period.
Key facts
- An attacker obtained the WebAuth key Keystone uses to verify whether a device is genuine.
- Customer shipping data, including names, contact details, and addresses, was leaked for approximately 26,000 records.
- No payment information or wallet keys were stolen during the breach.
- Keystone will destroy almost 19,000 units of existing un-shipped inventory and issue new devices with a new verification key.
- The company admitted its automated data deletion tool did not operate reliably, retaining data beyond the permitted period.
Why it matters
The theft of the device verification key creates a risk of scammers impersonating staff to offer fraudulent refunds, replacement devices, or fixes for orders, as the attacker can potentially validate counterfeit hardware as genuine.