Keystone said on October 26 that an attacker accessed 25,964 buyer records and 12,873 incomplete checkout records in a website breach. The hardware-wallet maker also suspended shipments after the intruder obtained a key used to verify device authenticity, forcing it to destroy affected inventory.
Keystone says 25,964 buyer records and 12,873 checkout records were accessed
The accessed buyer records contained names, contact details, shipping addresses and order information, Keystone said in a company statement. The company separately identified 12,873 incomplete checkout records, without detailing the fields contained in those records.
The disclosure gives a fuller measure of the incident than Keystone's initial notice, which focused on customer shipping information taken from its website.
Stolen authentication key forces shipment suspension and device destruction
Keystone said the attacker exploited a vulnerability in a third-party data-monitoring tool and obtained the device-authentication key used to verify whether a wallet is genuine. It said shipments were suspended as a result.
The company said it would destroy 18,835 inventory devices containing the old key. That action makes the episode an operational security incident as well as a disclosure involving customer and order data.
Keystone says wallet secrets and payment data were unaffected
Recovery phrases, private keys, wallet credentials and payment information were not exposed, according to The Crypto Times' report on Keystone's disclosure.
Keystone advised customers not to move assets solely because of the incident.
At the same time, the company warned that customers who received devices after October 20 may need additional authenticity checks. The cited information did not specify what those checks would involve.
Website intrusion was detected October 20
Keystone initially disclosed the intrusion on October 24. It said it detected unauthorized website access on October 20 and confirmed on October 23, after reviewing Shopify API activity, that customer shipping information had been obtained, according to Unchained.
The October 26 update added the number of affected buyer and checkout records, alongside the compromise of the device-authentication key and the resulting inventory destruction.
