Keystone disclosed on October 24, 2026, that an unauthorized party had obtained customer names, contact information, shipping addresses and purchase details through its website. The company said private keys, recovery phrases and payment information were not compromised. It did not say how many buyers were affected or precisely how the access occurred.
Keystone said it detected suspicious access on October 20, confirmed the data exposure by October 23, then blocked the intrusion, patched the vulnerability and began notifying customers. It warned that the exposed information could be used in fraudulent refund offers, replacement-device offers or messages seeking sensitive information.
