Keystone cuts customer data retention to 90 days, scraps 18,835 devices tied to old keys

Hardware wallet maker Keystone said its latest response to a security incident will include shorter customer data retention, the destruction of inventory tied to old verification keys, and a temporary shipping halt for certain orders. The company said the incident involved 25,964 buyer records containing personal information. It also warned that device verification keys obtained by an attacker could be used to produce counterfeit devices capable of passing checks on Keystone’s official website. In response, Keystone said it will stop using the old keys and destroy 18,835 devices in inventory that rely on them. Shipments for unfulfilled orders placed through its website have been paused and will resume after devices using new keys enter production. Keystone also said it will reduce the retention period for customer personal information from 180 days to 90 days. The company added that devices received after Oct. 20 that still use the old verification keys cannot be fully cleared of counterfeit risk even if they pass verification on the official site, and advised users to contact customer support for additional confirmation.