Keystone Reports Customer Data Exposure After Shopify API Intrusion
Summary
Keystone says attackers accessed its web platform through internal Shopify APIs and exfiltrated customer names, contact and shipping details, and purchase histories. The company says wallet keys and seed phrases were not exposed; customers reported impersonation calls.
Key points
- Keystone disclosed an unauthorized intrusion; its engineers detected anomalous activity targeting internal Shopify APIs.
- The article reports that attackers exfiltrated customer names, contact details, shipping addresses, and purchase histories.
- Keystone said cryptographic keys and seed phrases were not compromised.
- Customers reported calls from people impersonating Montreal police and citing transaction details to obtain more personal information.
- The article says customers with 2024 orders received fraudulent calls, raising questions about the company's 180-day data-deletion pledge.
- Keystone did not disclose the timeframe during which customer records may have been exposed.
Article Details
- Victim Organization
- Keystone
- Incident Type
- Unauthorized intrusion into Keystone's web platform and exfiltration of customer data
- Data Types Exposed
- Names
- Contact details
- Shipping addresses
- Purchase histories
- Operational Impact
- Customer records were exposed. The article says customer cryptographic keys and private seed phrases were not compromised; exposed residential addresses may increase physical security risks.
- Ransom Or Extortion
- No ransom demand is reported. Customers reportedly received fraudulent calls from people impersonating Montreal police and seeking additional personal information. Physical extortion and home invasions are described as potential risks, not confirmed incident activity.
- Claim Status
- confirmed