Old customer data is breach data

Published 2026-10-30 · 4 min read · Samtaro Security & Legal

What happened

On 26 October 2026 Keystone, a hardware-wallet maker, published a statement on its official X account about a breach of its website (Keystone statement). In its own words:

• Its monitoring detected unusual access on 20 October 2026. The attacker "exploited a vulnerability in a third-party data monitoring tool used by our website to escalate privileges".
• The incident involved 51,083 buyer records from its Shopify store. 25,119 had already been erased under its retention policy. The remaining 25,964 still held names, contact details, shipping addresses and order information.
• Its policy said buyer records should be erased after 180 days, but the automated erasure tool "did not operate reliably", and the failures weren't noticed in time.
• 12,873 unpaid checkout records, with names, contact details and shipping information, were also included as a precaution.
• The attacker also obtained a device-authentication key, so Keystone is destroying 18,835 devices in inventory. Payment details, recovery phrases and private keys were not involved.

Why it matters for a small business in Qatar

Most Doha SMEs don't hold signing keys, but many run a Shopify, WooCommerce or booking site with a handful of plug-ins and tracking tools. The two lessons transfer directly:

1. Every third-party tool is part of your attack surface. The way in was a monitoring tool on the website, not the store platform itself.
2. Data you have already promised to delete is still breach data until it is gone. Keystone says some of the exposed buyer records had been kept beyond the period its own policy allowed.

Qatar's PDPPL (Law No. 13 of 2016) includes storage limitation among the principles NCSA highlights, drawn from Article 10 (see NCSA's seven principles). Abandoned carts and old form submissions are exactly the kind of data that piles up unnoticed.

Five checks you can do this week

• List every app, plug-in and script on your site, and remove the ones nobody uses
• Check which apps have admin or customer-data access in your store dashboard, and reduce it where you can
• Write down how long you keep orders, abandoned checkouts and form submissions, and put it in your privacy notice
• If deletion is automated, confirm once a month that it actually ran, for example by searching for a customer older than your cut-off
• Keep a short incident plan. NCSA's guideline expects notice within 72 hours for a breach that can cause serious damage (GCC breach notification)

What a website scan can see

Our automated, passive scan lists the third-party analytics and advertising tags your public pages load and checks whether a privacy notice is linked. It can't see your store's admin apps or your retention settings; those need your own review. It is not a security audit or penetration test, and it is not legal advice.

Start with the free mini-scan.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.