Affected Keystone customers say a breach exposed order information the hardware wallet maker said it would delete after 180 days. While private keys appear not to have been compromised, users should watch for phishing and strengthen account security.