Keystone, a maker of crypto hardware wallets, confirmed on 23 October unauthorised access to data from its Shopify-based online store, which it had detected on 20 October. Names, contact details, shipping addresses and order information were exposed. The company says no private keys or recovery phrases were affected, as the manufacturer never holds them. Customers dispute the company's promise to delete shipping data after 180 days, saying that data from older orders was also exposed.

What it means: A leak of customer data from a wallet maker is especially dangerous, because it reveals who probably holds crypto-assets and where they live. After earlier similar leaks at other companies, waves of phishing, phone scams and in some cases threats of physical violence followed. Greek Keystone customers should be very careful with emails, texts or calls that mention their order and ask for a software update, confirmation of details or their recovery phrase. No legitimate manufacturer ever asks for a recovery phrase. Software updates should come only from the official app and website. The deletion issue has a legal side too: under the GDPR, a company that says it deletes data after a set period must actually do so, and keeping older records increases the harm when a breach happens. European customers have the right to ask what data is held about them and, if they get no answer, to turn to their data protection authority. For Greek online shops, the lesson is to check that data retention policies are also applied on the third-party platforms that host them, not just in their own systems.

Read the original on The Block

Related service: Custom software

Related stories