Keystone confirms website breach exposing customer shipping data

Keystone confirmed a website security breach after detecting suspicious activity earlier in the week. The company verified the incident by reviewing API activity with Shopify. The exposed data included customer names, contact details, shipping addresses, and order items. Keystone stated it blocked access, fixed the vulnerability, opened an investigation, and emailed affected customers. The company warned that the exposed information could be used for targeted phishing attacks.

Security researcher Taylor Monahan raised concerns that leaking shipping addresses could expose customers to physical attacks and kidnappings. CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, with physical threats increasing by 33% compared to the same period last year. Keystone noted it reduced its customer data retention period to 180 days following security incidents affecting other manufacturers in a 2023 blog post. However, some customers received breach notifications despite purchasing their devices more than two years ago.

An X user named 'OG DEGEN' reported receiving a call from a scammer claiming to be law enforcement investigating a fraud case, referencing personal information from a 2024 order. Another user, trintaetres, received an email notification despite buying the device over two years ago. Keystone did not disclose how many customers were impacted. Cointelegraph contacted Keystone to ask about customer information from purchases made more than 180 days earlier and the number of affected customers, but the company did not respond by publication time.