Halil, the two events must be treated separately. FACT: Keystone reported 25,964 completed-purchase records and 12,873 abandoned-checkout records; reported fields include names, contact details, shipping addresses, products, and prices. That is the privacy incident. Separately, the stolen WebAuth device-authentication key could allow counterfeit devices to pass Keystone’s verification check; it does not, without further evidence, establish compromise of genuine devices, private keys, recovery phrases, passwords, or funds. Keystone should immediately disclose which models, serial ranges, manufacturing batches, and sales channels used the old key; whether any affected units reached customers; what its verifier can and cannot still prove; and the replacement or recall process. It should not claim either “funds are compromised” or “all devices are safe” until those questions are resolved.
If GDPR applies to a relevant Keystone entity or downstream controller, Article 33 requires supervisory-authority notification without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to risk individuals’ rights and freedoms. Article 34 requires direct, clear communication where the likely risk is high, including the breach’s nature, likely consequences, contact point, and mitigation. ASSESSMENT: Identified hardware-wallet ownership, home address, purchase value, and contact details create credible targeted-phishing, impersonation, extortion, and physical-security risks; that makes customer communication prudent now even before every jurisdictional conclusion is complete. The notice should say that attackers can tailor messages using real order details; Keystone will never request a seed phrase or private key; customers should distrust unsolicited “verification,” firmware, replacement, or recovery instructions; and official support domains and replacement procedures must be independently verified.
For other regimes, the missing facts are decisive: customer residence, contracting and record-owning entity, encryption status, exact access or exfiltration evidence, discovery dates for each controller, public-company status, and whether any entity is actually a regulated financial institution or crypto-asset service provider. A hardware-wallet manufacturer is not automatically subject to DORA, NIS2, SEC cyber-disclosure rules, or financial-sector incident reporting merely because its product holds crypto assets. Downstream sellers should determine whether they supplied the records, independently controlled them, sold old-key inventory, or made authentication claims; those facts determine whether they must notify directly or instead support Keystone’s notice. I could not verify current jurisdiction-specific clocks or thresholds for California, other US states, the UK, Turkey, or Asian jurisdictions from official material here, so Keystone should not publish a universal legal conclusion—only a jurisdiction-by-jurisdiction notice matrix tied to verified customer counts and entity awareness dates.