Keystone Hardware Wallet Discloses Shopify Store Breach Exposing Customer Shipping and Order Data

Hong Kong-based Keystone confirmed that an unauthorized third party compromised its Shopify storefront between October 20 and October 23, 2026, leaking buyer names, contact details, shipping addresses, and order histories while leaving private keys and payment cards untouched.

* E-commerce infrastructure remains the weak link: While Keystone’s air-gapped devices keep private keys offline, the vendor's Shopify API integration provided attackers direct visibility into customer shipment destinations and order values. * The hardware sector carries physical baggage: Competitors like Trezor and Ledger experienced similar supplier-side breaches in recent cycles, turning crypto holders' personal addresses into targets for sophisticated extortion and mail-based impersonation campaigns. * Data retention promises face scrutiny: Despite a public policy stating customer data would clear after a set window, buyers with orders older than the cutoff received incident notifications, triggering trust questions around corporate data hygiene.

Expect an influx of high-context phishing attempts and social engineering attacks targeting your inbox and physical mailbox as Keystone finalizes its forensic investigation report.