Keystone Says Intruder Took Customer Names and Addresses From Website

The exposure matters less for what was taken than for what it signals: for a hardware wallet maker, names and addresses are the raw material for targeted phishing and physical-risk profiling, even with payment data and recovery phrases untouched. The more telling detail is the company's admission that its own published deletion policies describe the 180-day shipping-data practice in differing terms — a documentation gap that undercuts confidence in the operational discipline behind customer data handling. Whether that inconsistency is corrected, and how transparently the company characterizes the breach's scope, is the open question worth watching.