Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.
Some customer records should have been deleted under Keystone’s 180-day retention policy, but an automated deletion tool failed without the company detecting the issue, it said.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.
Keystone’s update came a day after hardware wallet maker Foundation disclosed a separate breach in which attackers sent phishing emails that appeared to come from its official domains.
Foundation said it had identified more than 23,000 phishing email attempts. It found no evidence that Passport devices or private keys were compromised.
Foundation also found older database copies that its 60-day data deletion process had missed. In an update, it said attackers could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were accessed.
Keystone said devices delivered before Oct. 20 remain safe to use if they pass authentication, while customers who received devices using the old key after that date should seek further checks before use.
The company said users do not need to move funds due to the breach alone and warned against fake recall or asset migration messages.
