Keystone detected unauthorized access to its website on October 20 and confirmed a shipping-data breach on October 23 after reviewing API activity with Shopify. The hardware wallet maker disclosed that customer shipping information was exposed during the incident. The breach comes amid scrutiny of Keystone's data retention practices, as a January X post, its privacy policy, and help center describe the company's 180-day data deletion rule in inconsistent terms.