The order details leaked this time by Keystone even included prices. Who bought one device, who bought the most expensive model, who ordered several at once—the scammers now have a list ranked by how much people spent.
On October 24, Keystone apologized on X: it discovered unauthorized access to its website on October 20, and after reviewing its Shopify API logs on October 23, confirmed that a third party had taken customers’ names, contact details, shipping addresses, and order details, including what they bought and how much they paid. The company said that recovery phrases, private keys, and bank card details were not exposed. It has yet to disclose how many people were affected or how the breach happened.
I think everyone is talking about addresses, but the “price” column is actually more alarming. An address tells someone where you live; the order amount tells them whether you’re worth paying a visit. In a scammer’s eyes, someone who bought one entry-level device and someone who ordered several at once are completely different priorities.
The Block reported another detail on October 25: Keystone has long said that shipping information is deleted 180 days after an order, but some users said they received breach notifications about orders they placed two years ago. So longtime customers shouldn’t assume this has nothing to do with them.
Over the next few weeks, expect calls pretending to be from the company offering refunds, texts about replacements, and “replacement devices” delivered to your door. Keystone’s own warning is straightforward: never enter your recovery phrase into a device you didn’t order.
No matter how cold you keep your wallet, your order history is already hot.
#Keystone网站遭入侵泄露买家收货地址 #HardwareWallet
On October 24, Keystone apologized on X: it discovered unauthorized access to its website on October 20, and after reviewing its Shopify API logs on October 23, confirmed that a third party had taken customers’ names, contact details, shipping addresses, and order details, including what they bought and how much they paid. The company said that recovery phrases, private keys, and bank card details were not exposed. It has yet to disclose how many people were affected or how the breach happened.
I think everyone is talking about addresses, but the “price” column is actually more alarming. An address tells someone where you live; the order amount tells them whether you’re worth paying a visit. In a scammer’s eyes, someone who bought one entry-level device and someone who ordered several at once are completely different priorities.
The Block reported another detail on October 25: Keystone has long said that shipping information is deleted 180 days after an order, but some users said they received breach notifications about orders they placed two years ago. So longtime customers shouldn’t assume this has nothing to do with them.
Over the next few weeks, expect calls pretending to be from the company offering refunds, texts about replacements, and “replacement devices” delivered to your door. Keystone’s own warning is straightforward: never enter your recovery phrase into a device you didn’t order.
No matter how cold you keep your wallet, your order history is already hot.
#Keystone网站遭入侵泄露买家收货地址 #HardwareWallet