Keystone said attackers exploited a third party data monitoring tool on its official website, detected Oct. 20 and confirmed Oct. 23 after checking API activity with Shopify. Keystone's announcement

Exposed were 25,964 purchase records with names, contact details, shipping addresses and order info including items and prices, plus 12,873 incomplete checkout records, out of 51,083 Shopify buyer records. Amazon and other channels were not affected. WuBlockchain

Attackers also obtained a WebAuth device authentication key that could let counterfeit wallets pass official checks. Keystone will destroy 18,835 unsold devices using the old key, pause unshipped orders and switch new production to a replacement key. WuBlockchain

Not exposed were recovery phrases, private keys, wallet credentials, bank payment info, ID numbers and transaction signing. Keystone blocked access, fixed the flaw and is emailing affected customers. Keystone's article

Impact is targeted phishing and physical risk. Keystone warns scammers may pose as support by phone, text, email or mail offering refunds or replacements. Coverage notes fears of targeted scams and wrench attacks. Cointelegraph

Do not share recovery phrases or private keys, enter a phrase into a device you did not order, or click links in unexpected messages. Keystone says it will never ask for phrases or keys. Type keyst.one yourself and contact [email protected] if unsure.