Foundation breach: phishing emails from official domains carried some customers' addresses and phone numbers

What happened

Foundation, the maker of the Passport bitcoin hardware wallet, announced late on October 25, 2026 that spam and phishing emails had been sent that appeared to come from its official domains. The company traced the sending to one or more compromised Cloudflare API keys, revoked all of its API keys, and said the malicious domain linked in the messages had been taken down. Its chief executive, Zach Herbert, then said some of the company’s backend infrastructure was compromised through a vulnerability in a self-hosted app, that attackers were likely able to compromise the customer support inbox, and that the team cut off the attackers’ ability to send email and removed them from its systems within 10 minutes of user reports. The phishing messages carried a fake urgent recall: a display module from a supplier had supposedly been modified, funds were supposedly being taken from affected devices, and recipients were steered toward giving up their recovery (seed) phrases. In its report on the incident, published October 26, the company said it identified more than 23,000 phishing attempts across its infrastructure — 19,057 delivered through Mailgun and 1,503 through Google Workspace, with others blocked; several recipients received multiple copies, so those volumes do not equal the number of people affected. Foundation says Passport devices are not compromised and it found no evidence that devices or private keys were compromised.

Who is affected

Passport customers and other people whose details Foundation held. Some of the phishing emails themselves included customers’ mailing addresses or phone numbers; the chief executive first attributed that data to the support inbox, to other recent crypto leaks and possibly to recent orders on the company’s new Shopify store. The company’s later investigation update explained the larger source: its previous WooCommerce store had been configured to anonymise customer data 60 days after shipment, and in the admin panel buyer information appeared deleted — but earlier database migrations had duplicated records into auxiliary tables outside the primary view, and those historical copies retained names, phone numbers, email addresses and physical shipping addresses, along with refund requests and abandoned shopping carts from visitors who never completed an order. In that update the company said attackers could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were actually accessed. Reporting of the company’s report also says data from Shopify orders since the May 2026 migration may have been affected, because automated deletion tools for the new store were still in development.

How serious

The concrete risk is already in the wild, and it is unusually convincing: a phishing email that comes from the maker’s real domain, addresses the customer by name, and in some cases quotes their real home address or phone number, all in support of a fake safety recall for the device that holds their bitcoin. The goal of that message is the recovery phrase — anyone talked into entering it on the fake site, or into moving funds to a “safe” new wallet, hands over control of the wallet, and that loss is effectively irreversible. The devices themselves were not compromised, and neither were private keys held on them; the danger runs entirely through the customer believing the email. A home address tied to a hardware-wallet purchase also carries the same targeting risk as in the Keystone case covered on this desk: it identifies a person, at a real address, who owns a device used to store cryptocurrency.

What to do now

If you own a Passport, treat any email about a recall, a compromised display module, stolen funds or an urgent move to a new recovery phrase as a scam, even if it comes from an official-looking Foundation address and quotes your real address — that is exactly the campaign the company describes. Never enter your recovery phrase anywhere because of an email, and do not move funds because a message tells you to. Foundation says Passport devices and the funds on them are safe; if you need to check anything about your device or an order, go to the company’s official site yourself rather than through a link in a message. If you already entered a recovery phrase on a site an email sent you to, treat that wallet as compromised and move its funds to a new wallet with a new phrase generated on a device you trust, through steps you start yourself.

Sources: CoinDesk · Gizmodo · Crypto Economy, reporting the company’s report