Keystone customers say the breach exposed orders the wallet maker promised to delete after 180 days, as one reports a two-year-old purchase in the leak

Keystone customers are questioning whether the hardware wallet maker kept its promise to delete shipping data, after a breach of its online store exposed orders that appear to be well past the company's stated 180-day limit, The Block reported on October 25.

Keystone said it detected unauthorised access to its official website on October 20 and confirmed on October 23, after reviewing API activity with Shopify, its e-commerce platform, that a third party had taken customer names, contact details, shipping addresses and order details. Payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed, it said. In an X post on Saturday it apologised: "You trusted us with those details, and we're sorry we didn't keep them safe."

Keystone made the deletion promise publicly on January 5, the day Ledger customers were told of a leak at its e-commerce partner, when Keystone posted that shipping data is "permanently deleted" 180 days after an order. Its Privacy Promise page says the same, The Block reported, although its privacy policy, last updated in May 2021, describes the rule differently.

One customer said they received a breach notice for a purchase made more than two years ago; another counted 214 days between their last order and the breach. A third said a caller spoofing a Montreal police number knew details matching a 2024 order. The Block said it could not verify those claims. Keystone has not said how many customers are affected, and has promised a detailed report in the coming days.