Keystone said it detected unauthorized website access on October 20 and confirmed theft of customer shipping information on October 23 after reviewing Shopify API activity. Exposed data includes names, contact details, addresses and order items and prices. The company says payment information, recovery phrases and private keys were not exposed. It has blocked access, fixed the vulnerability and begun notifying customers, with a detailed report still pending. It warns about impersonators offering refunds or replacement devices. Users should not enter recovery phrases into devices they did not order or follow unexpected message links.