Keystone website breach exposed buyer data and the device authentication key

Keystone detected unauthorized access to its official website on 20 October 2026. In its update of 26 October the company said the attacker used a vulnerability in a third-party data monitoring tool on the site to escalate privileges. 25,964 buyer records from 2024–2026 still held personal data — names, contact details, shipping addresses and order details — and 12,873 unpaid checkout records are counted as well. Keystone acknowledged that its promise to erase shipping data within 180 days had not been fully kept; it now keeps that data for at most 90 days.

The attacker also obtained the key Keystone’s website uses to check that a device is genuine. The key is written into each device at the factory and cannot be changed, so Keystone will scrap the 18,835 devices in stock that carry it and give newly made devices a new key. According to Keystone, recovery phrases, private keys and payment details were not exposed, and owners are not asked to move funds because of this incident.

Keystone’s advice:

• A device delivered before 20 October 2026 that passes the authenticity check is genuine.
• For a device received after 20 October with the old key, contact Keystone support for additional verification before using it: Keystone cannot fully rule out a counterfeit even if the check passes.
• Keystone will not ask anyone to return a device. Treat “recall”, refund, migration or wallet-verification messages as scams.