Update Oct 26: Keystone says the intruder also stole its device authentication key; it will destroy 18,835 devices in inventory, and 25,964 buyer records were exposed. See the follow-up.

Keystone said on Oct 24 that it detected unauthorized access to its official website on Oct 20 and, after checking API activity with Shopify, confirmed on Oct 23 that a third party obtained customer shipping information.

• Exposed (per Keystone): names, contact details, shipping addresses and order details.
• Not exposed (per Keystone): payment data, private keys and recovery phrases. The wallets themselves are offline devices.
• Keystone says it blocked the access, fixed the vulnerability and emailed affected customers. It has not said how many people are affected and says a detailed report will follow in the coming days.
• Before the disclosure, a customer posted on Oct 23 that they had received a social-engineering call from a spoofed police number, which is the typical follow-on after wallet-customer leaks like the earlier Ledger and Trezor cases.

If you bought from Keystone: expect fake support emails, texts and calls offering refunds or replacement devices. Keystone will never ask for a seed phrase.