The Hong Kong wallet maker says unauthorized access to its website leaked names, shipping addresses, and purchase details. Recovery phrases and private keys were not involved.