What do you think about this user data leak from the famous keystone company

[Lontor]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?

https://x.com/KeystoneWallet/status/2114054080754770137

Keystone hardware wallet team released this news today, something they should have since Oct 20 so that people will be aware about what's happening.

[Dogedegen]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?

https://x.com/KeystoneWallet/status/2114054080754770137

Keystone hardware wallet team released this news today, something they should have since Oct 20 so that people will be aware about what's happening.

Why do you keep any of your information on any website? Why have social media or accounts on online store? Delete the account after each order, be the first to show an example!  People don't delete stuff like this and they don't want to, so magically they expect companies to act differently.. when companies are made from these same people that don't do it in their personal lives? How would that work logically? Also since people don't regularly delete stuff and are not used to it, a company that has this kind of policy is going to get a negative response because people like to complain about anything that they can. So why would some company be the first, sacrifice themselves just to prove a point in a world that does not care?

These data leaks are bad, but you need to be certain that everyone is responsible. Why did customers give their real info and not use a PO box? There are many things that a user could do if they cared..

[hmbdofficial]

These data leaks are bad, but you need to be certain that everyone is responsible. Why did customers give their real info and not use a PO box? There are many things that a user could do if they cared..

There is no justification for why customers should have given incorrect details, not everyone knows how to cut corners, if the company required you to submit and email or some personal information that are sensitive, people usually give correct details and trust that company with it. now the company has failed to keep the data secure and you’re blaming users that why didn’t they give wrong information. If a company fails, we should be able to tell them their mistakes and complain.

The only thing I like about this particular company was that they were bold to even come out and explain to users what really happened, some companies can have similar issue but will not speak up and making it more risky for users as the exposure might not be discovered early.

[Charles-Tim]

To buy a hardware wallet from a reseller, there could be a problem just like what happened to Ledger Nano users recently that bought from a reseller. If you buy the hardware wallet directly from the company, no privacy and which can threaten someone's security in some cases. I am just tired of hardware wallets. They are for saving huge amount of money and not for saving something worthless.

[Bitcoin.com97]

These data leaks are bad, but you need to be certain that everyone is responsible. Why did customers give their real info and not use a PO box? There are many things that a user could do if they cared..

There is no justification for why customers should have given incorrect details, not everyone knows how to cut corners, if the company required you to submit and email or some personal information that are sensitive, people usually give correct details and trust that company with it. now the company has failed to keep the data secure and you’re blaming users that why didn’t they give wrong information. If a company fails, we should be able to tell them their mistakes and complain.

The only thing I like about this particular company was that they were bold to even come out and explain to users what really happened, some companies can have similar issue but will not speak up and making it more risky for users as the exposure might not be discovered early.

Exactly, before one gives out their information to any company it's because they trusted them ,so if they decide to reveal or do evil with it ,it could be that their is a bad egg among them ,and should not blame the customer who trusted them, the good news they already came out to give their own side of the story even tho people are saying it took them time , possibly they could have said it on 20th of October, but it's courageous of them to speak out to clear the air.

I saw on comment section when people are saying they should have deleted those details,but truth be told, even in our phones we hardly delete things,even in our social media pages, if not for scammer and the rest activities happening, saving documents is not really bad.

[348Judah]

Why are hardware companies keeping customers information after they have successfully delivered their products?

What else do we expect from them? To discard user information after the delivery of the product they bought? Not possible because they will always give you enough reason to why they should keep the user information with them on their central server, the best is not to give your information in the first place and is it not possible to secure a hardware wallet without giving our kyc information?

Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Obviously part of it, but there are still many ways at which a third party can have access to our information as long as we are making use of a centralized service that request for our personal details and we render them.

[bhadz]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

That is valid, there is no reason for them to keep their customers' data, and this applies to all of the hardware wallet companies. I guess that the only reason for them is for future references and purposes for marketing and promos. They won't have any benefit of keeping people's data especially if it includes the sensitive ones, the address, credit card/banking details. We preach buying hardware wallets is a must and better way of keeping our funds, but if the first thing they can't protect is their customer's data then there's no point of trusting their hardware wallet itself anymore. Too tiring with all of the ruckus these hardware wallet companies are causing us.

[Dogedegen]

These data leaks are bad, but you need to be certain that everyone is responsible. Why did customers give their real info and not use a PO box? There are many things that a user could do if they cared..

There is no justification for why customers should have given incorrect details, not everyone knows how to cut corners, if the company required you to submit and email or some personal information that are sensitive, people usually give correct details and trust that company with it. now the company has failed to keep the data secure and you’re blaming users that why didn’t they give wrong information. If a company fails, we should be able to tell them their mistakes and complain.

The only thing I like about this particular company was that they were bold to even come out and explain to users what really happened, some companies can have similar issue but will not speak up and making it more risky for users as the exposure might not be discovered early.

What nonsense are you bringing up? Using PO boxes is not using incorrect details. Tactics and methods to avoid this kind of problem is basic knowledge how you can protect you from these kinds of attacks, but instead of being grown ups and accepting that you made a mistake you keep trying to blame someone else. This is a common tactic of immaturity that we see in these times, it is always someone elses fault but never the fault of the individual. But those that manage to avoid all these data leaks, platform hacks and whatever else is happening somehow just got lucky I guess. Knowledge and doing the right thing didn't have anything to do with it, they just keep getting lucky and the users that do get compromised are always the victims and have never done anything wrong.

When you submit your data to any account online, you are already forever partially responsible for what happens to this data. Time to be grown ups and be responsible for your own actions, enough trying to avoid responsibility. As long as you have the choice to not do it or use means to limit the damage, it is always going to be your responsibility.

[Churchillvv]

buying from resellers is a very huge case since the recent issues however if one can't trust small things like this then its a big issue in the crypto world entirely.

Perhaps i have come to terms with the fact that nothing on the internet is save regardless of the claims, just have to keep that in mind while dealing with hardware wallet devices.

I am just tired of hardware wallets. They are for saving huge amount of money and not for saving something worthless.

When something small can not be secured is it something big that will be secured?

[Cryptomultiplier]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?

https://x.com/KeystoneWallet/status/2114054080754770137

Keystone hardware wallet team released this news today, something they should have since Oct 20 so that people will be aware about what's happening.

Better late than never I must say but the did has already been done because data has been breached and leaked via its Shopify API integration and because am sure the recent hacks that coldcard, ledger, Trezor also saw, they thought it wise to let their users know on time.
These hacks are becoming too frequent with hardware wallet and the service providers or retailers and I don't know if to say this is a secret move to dis encourage the use of hardware wallet but it definitely looks like it and am sure that this isn't the end yet.

So it's a personal responsibility to suit up and find more secure ways to store ones coins and be rather discreet or think like hackers in order to misdirect information that doesn't lead straight to us or our portfolios.
This is a breach of trust for such businesses and if a better option isn't going to come up yet, we might find adopters without wallets and potential adopters with knowledge but no interest in investing due to these threats.

[PrivacyG]

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?  

Some will lie and keep them even if they claim they do not, others will delete every thing they can, the thing is that there are laws that prevent some of that information from being deleted.  You can not really delete every thing about a customer, even in Europe where there is GDPR the text of the law it self says it.  Some data will be retained for many years.

Instead.  What they could do is keep at least most of that information secure in offline storage as soon as an order is complete.  If authorities request any information, it can be accessed and shared.  If a bad intended person tries to get their hands on it, it can not be hacked.

[tabas]

Reading the replies on that tweet is ecstatic. Look at how the majority is valuing the privacy that these companies should have kept safe or if they can't keep it safe, they should dispose the infos right away or for a period of time. Still haven't moved on from what to Ledger, and another one. The new standard for choosing a better hardware wallet will not only be about airgap and reputation of their product, but also on how they keep records of their customers. They have never learned on the past leaks from other competitors.

[Sandra_hakeem]

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?  

~snip the thing is that there are laws that prevent some of that information from being deleted.  You can not really delete every thing about a customer, even in Europe where there is GDPR the text of the law it self says it.  Some data will be retained for many years.

Oh c'monn! Are we now entirely defenseless? So they retain sensitive information about me upon a purchase because there are laws that says so (which I totally don't have a problem about), and you explained yet another existing data privacy law that should, in one way or the other, protect a user's interest, but then something like this happens. I know they have taken accountability for their carelessness, but this is a direct quote from their release:

Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.

Those fillers don't include home addresses, but considering how lazy people have been lately about protecting their assets, a greater portion of them may never find out about this release yet, scammers are on the loose!!

My point is and perhaps I'm wrong, this could just be one of those cases that people with a huge volume of crypto are traced and brutally murdered at their own residence by strangers.

[X-ray]

A good hardware company limit shipping information retention normally only to 30d or even less, more than that and really don't care about people's privacy.

But you know what, I think they keep these informations as long as possible just in case there is chargeback fraud and they need the information to win the case.

They might say, they keep shipping information for a long time for order completion process including returning, warranty claim, etc but that's only part of the story.

Besides the information they need to keep for tax purpose, I see no reason why they should keep shipping information for that long.

Classic hardware wallet mistake, they're business after all and profit above everything else.

[RGBTC]

Why do you keep any of your information on any website? Why have social media or accounts on online store? Delete the account after each order, be the first to show an example! 

Personal information is highly valuable; it may well be copied dozens of times the very instant you hit the "save" button. Consider, for instance, the privacy policy of Keystone:

We use Shopify to power our online store. You can read more about how Shopify uses your Personal Information here: ....
~

We may share the following information with:

Data analytics providers,
Vendors and service providers,
AI customer assistant, automation, and customer support service providers,
Security, fraud-prevention, and bot-prevention service providers, including Cloudflare,
Social networks,
Third parties integrated into our services,
Third parties as required by law and similar disclosures,
Affiliates,
Third parties in connection with a merger, sale, or asset transfer, and
Other third parties for whom we have obtained your permission to disclose your Personal Information.
Opt-out and Data Retention

Deleting an account does not necessarily mean that your data is removed from the databases of all involved third parties, unless the service in question (in this case, Keystone) also holds authorization to edit those external databases. We tend to be critical only when the service to which we originally submitted our information suffers a data breach, yet we remain indifferent when a breach occurs elsewhere along the partnership chain.

Why did customers give their real info and not use a PO box?

They simply do not want any legal issues to originate from them which could potentially eliminate certain consumer protection. Nevertheless, provide false info remains an option, though most people would choose the straightforward, above-board path when conducting transactions involving thousands of dollars.

[SamReomo]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

It makes no sense to keep customer information after selling them hardware wallets, the companies are greedy that's the main reason why they do such things. I believe it's much better to make your own old system air gapped by installing a new OS in it and then use Electrum cold wallet to be on safe end. As that is a better approach to have maximum privacy than purchasing hardware wallet form companies that  keep information of the customers.

[joniboini]

They simply do not want any legal issues to originate from them which could potentially eliminate certain consumer protection. Nevertheless, provide false info remains an option, though most people would choose the straightforward, above-board path when conducting transactions involving thousands of dollars.

Is using PO Box a valid cause to eliminate consumer protection from them though? As far as I can tell PO Box is a popular service that isn't illegal at all. Maybe it depends on where you live and how easy it is to access them, but it sounds a bit far fetched to say using PO Box is illegal on their TOS. I remember reading a comment on Trezor delivery saying that their shipping partners sadly don't ship them to PO Box address 5 years ago, but there's no implication using one is inherently breaking their TOS[1]. Not sure if anything has changed.

[1] https://www.reddit.com/r/TREZOR/comments/u4yvu0/want_to_buy_a_trezor_but_dont_want_to_give_home/

[Bryan jessy]

There are companies with reputation so if someone actually wants to purchase a product from them he will willing give out his required details, I believe there is a section where the customers details are in that platform so customer can delete it after making purchases from the company though I am not sure if every companies allow it, but if any company does not make reservations for their customers to delete their details after purchase then they should secure the site and protect their costumers  information. There is this company I usually purchase things from the moment I make payments and it's confirmed I delete my necessary details because you can not totally relay on others for such security.

[Outhue]

Now I am no longer happy with keystone because they are caught lying about everything data related, this was asked of them some months ago I guess when Ledger customer data was leaked and they proudly said that Keystone customers who purchased their products have all been erased,

Unfortunately they lied.

They promised to delete information in just 180 days after you bought their products and they even give access to early deletion by asking their CS team to get it done before 180 days, it was all a lie..

Here is the proof...

https://x.com/KeystoneWallet/status/2008216639817605467

[m2017]

Why are hardware companies keeping customers information after they have successfully delivered their products?

And how do you propose handling the replacement of these HW-devices during the warranty period, for instance, in the event of a HW_manufacturing defect or a HW-device failing prematurely?

Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

This happens due to an inadequate level of protection when such data is stored. Why does no one encrypt personal data while it is being stored?

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?

Because otherwise, some clever person could send them a broken HW-device to be replaced under warranty. The HW-manufacturer is trying to protect itself. But I also don’t understand why they couldn’t anonymize personal data (or instance, by assigning a unique alphanumeric identifier that confirms you are a customer) and use that instead. Naturally, this would also involve significantly shortening the retention period for customer's personal information.

https://x.com/KeystoneWallet/status/2114054080754770137

Keystone hardware wallet team released this news today, something they should have since Oct 20 so that people will be aware about what's happening.

The most successful year yet for hacking HW-manufacturers is not over. Which company will be next? Perhaps it’s time for them to join forces and collectively develop methods for the anonymous delivery of HW-devices, without the need to collect and store personal data?

Why do you keep any of your information on any website? Why have social media or accounts on online store? Delete the account after each order, be the first to show an example!  Grin People don't delete stuff like this and they don't want to, so magically they expect companies to act differently.. when companies are made from these same people that don't do it in their personal lives?

Okay. I guess I’ll go ahead and delete my passport and all my other documents, then.

Are you serious? And how is a buyer supposed to receive a package containing a HW-device? In case you didn’t know, no postal service will hand over a package without supporting identification documents.

These data leaks are bad, but you need to be certain that everyone is responsible. Why did customers give their real info and not use a PO box? There are many things that a user could do if they cared..

Because it’s not available everywhere!

There is no justification for why customers should have given incorrect details, not everyone knows how to cut corners, if the company required you to submit and email or some personal information that are sensitive, people usually give correct details

To receive the parcel they paid for.