Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.

Some customer records should have been deleted under Keystone’s 180-day retention policy, but an automated deletion tool failed without the company detecting the issue, it said.

“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.

Keystone’s update came a day after hardware wallet maker Foundation disclosed a separate breach in which attackers sent phishing emails that appeared to come from its official domains.

Foundation said it had identified more than 23,000 phishing email attempts. It found no evidence that Passport devices or private keys were…