What do you think about this user data leak from the famous keystone company

[EjiukaSpecial]

I just finished reading the statement from Keystone Hardware Wallet's official X handle and despite how long and detailed it was, I couldn't find where they talked about compensating the affected customers. There's nothing wrong with apologising to their customers but what happens to the people whose personal information has already been exposed?

In recent times, we've seen different cases where people lost millions in Bitcoin and other assets not necessarily because they were careless in how they handled their private keys but because companies they trusted were compromised. Imagine doing everything possible to secure your hard-earned coins, only to have your privacy put at risk by the very company you trusted and all you get in return is an apology.

I think it's high time we begin to raise concerns about how hardware wallet customers should be protected. It's time that hardware wallet companies introduce clear customer protection policies that cover situations like this including compensation where negligence is established. It would help in forcing these companies to take security seriously. If a company knows that its failure to protect customers could come with a real financial cost, they'll do everything possible to avert any form of security gap.

[RGBTC]

Is using PO Box a valid cause to eliminate consumer protection from them though? As far as I can tell PO Box is a popular service that isn't illegal at all. Maybe it depends on where you live and how easy it is to access them, but it sounds a bit far fetched to say using PO Box is illegal on their TOS. I remember reading a comment on Trezor delivery saying that their shipping partners sadly don't ship them to PO Box address 5 years ago, but there's no implication using one is inherently breaking their TOS[1]. Not sure if anything has changed.

[1] https://www.reddit.com/r/TREZOR/comments/u4yvu0/want_to_buy_a_trezor_but_dont_want_to_give_home/

I am not saying that a PO box address is illegal or not real information; I am simply pointing out that speaking "real information" entails much more, such as one's real name, contact details, etc. especially since the guy in question instructs us to create what are essentially like "disposable" accounts for every order (create, place order, delete). I do not think that such a method would consistently provide the same profile details.

And I think there is no longer any doubt that choosing greater privacy can diminish consumer protection, as there may be no legit information left that could be used to seek redress.

[#CapsLOck]

What matters isn't if customers use a PO box. It's how companies do to reduce the damages when a data breach occurs. A hardware wallet can safeguard private keys. But the buyer's identity and address will be unattached. These are two different security risks. Businesses should only ask for the information they need. Limit access and disposal of personal information when no longer needed. Customers can do their part as well. But not the company's.

[Mrbluntzy]

Instead.  What they could do is keep at least most of that information secure in offline storage as soon as an order is complete.  If authorities request any information, it can be accessed and shared.  If a bad intended person tries to get their hands on it, it can not be hacked.

Meaning that even with hardware wallet, a Bitcoiner that seeks privacy is not still 100% guaranteed about it since their data is being stored by the seller and these data can be handed to the authorities if they request for it in the future. I feel disappointed knowing this is how it works, I really think that it's not every kind of item that sellers have to keep the information of the buyer on their system.

[Hamza2424]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Bro, these companies have always kept their customers' data, and typically, when you visit a site like Uber, they collect more than 100 data metrics from you, like your battery health or phone OS. They use such data to organize their recommendation systems accordingly so they can give you deals that suit you best.

These recommendation systems are now being optimized using AI, and that's why data has become even more important.

People are using keywords to promote their own sites in AI platforms like ChatGPT. They are even using those words and keywords that have not been enforced by the real platform, but they are using them to push their sites into it. I have encountered this several times, but I don't know how they are doing it.

[Lida93]

Why are hardware companies keeping customers information after they have successfully delivered their products? Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Most especially crypto hardware wallets that claimed to be airgapped, what business do they have with keeping customers addresses after many months have passed? Why can't they get rid of every information once delivery is been made?

I don't support getting rid of information mostly when it's with a service delivery company those information are needed to be kept for record purposes just in case something that could be proven for evidence in any case arises. If the authority demands for the records just to ensure annual capital tax of the company aligns correctly with what they're getting

I just believe that these companies are not doing more with sophistication security of customers vital data as they're heavily concerned with making profit and staying in business. But they fail to grasp that when they fail with their security the company would ultimately suffer for it.

[serjent05]

Why are hardware companies keeping customers information after they have successfully delivered their products?

What else do we expect from them? To discard user information after the delivery of the product they bought? Not possible because they will always give you enough reason to why they should keep the user information with them on their central server, the best is not to give your information in the first place and is it not possible to secure a hardware wallet without giving our kyc information?

Online orders are shipped, and the shipping needs information, the name and the destination, so it is not actually the typical KYC but information about the buyer- who and where.  They keep this for future use or it is also possible that they sell this information to other party.  This deal of selling has an NDA to keep secret that they are selling information.  It sounds absurd, but it is really possible. If they are not collecint DATA from customer, then why are they keeping them.

Isn't this the reason why scammers are able to get their hands on people's addresses and emails?

Yes, when the data is breached, the information is leaked and those who stole it can sell them to scammers.

[NotFuzzyWarm]

In case you didn’t know, no postal service will hand over a package without supporting identification documents.

At least in the US, all delivery services like FedEx, UPS, DHL, USPS, ect. all just drop off the package. So do local retailers offering home delivery such as Walmart, Homedepot, Kroger, etc

Unless it is an insured high value item or specifically requested by the customer no one has to be around to provide ID for package deliveries.