Foundation Confirms 23,000 Phishing Emails After Data Breach

Foundation, the maker of the Passport Bitcoin hardware wallet, has confirmed that attackers sent more than 23,000 phishing email attempts through its email systems. The incident also put thousands of customer records at risk, including names, email addresses, mailing addresses and phone numbers.

Users on social media spotted the suspicious emails ahead of the announcement and shared the news with each other.

Foundation first announced the incident late on October 25, 2026, after customers reported suspicious emails that appeared to come from its official domains.

The company traced the emails to one or more compromised Cloudflare API keys. These keys allow software to access certain online services and account functions.

Foundation revoked its API keys and took down the malicious domain used in the phishing campaign.

In updates posted on X, Foundation explained that weaknesses in its old online store allowed personal information to remain in its databases even after orders appeared to have been redacted. The company said it had found no evidence that Passport devices or the private keys stored on them were compromised.

“Funds stored on Passport are safe and Passport hardware is not compromised,” the company said in its initial announcement.

CEO Zach Herbert later revealed that attackers had also gained access to parts of Foundation’s backend systems through a vulnerability in a self-hosted application. He said the attackers were likely able to access the company’s customer-support inbox.

In the last part of his message, he apologized to users, saying he is very sorry.

According to Herbert, Foundation stopped the unauthorized email activity within 10 minutes of receiving reports from users.

In its first investigation update, Foundation said it had identified more than 23,000 phishing email attempts across its email systems.

Of these, 19,057 messages were sent through Mailgun and 1,503 through Google Workspace. Some people received multiple emails, while other attempts failed or were blocked.

The company said these numbers did not show how many people had their personal information exposed.

Recipients reported that the emails included their names, mailing addresses, phone numbers and details of previous purchases. Some messages referred to orders placed months or even years earlier.

The attackers used this information to make their emails look genuine. The messages attempted to convince Passport users that their bitcoin was at risk and encouraged them to follow instructions that could lead to the theft of their funds.

This type of phishing attack often aims to steal a wallet’s recovery phrase. Anyone who obtains that phrase can restore the wallet and move its bitcoin without needing the original hardware device.

Foundation’s investigation uncovered problems with its former WooCommerce online store.

Before moving to Shopify in May 2026, the company used WooCommerce to process orders. Its system was designed to remove customer details 60 days after an order was shipped.

However, earlier database migrations had created copies of orders in newer database tables while leaving the original records in older tables.

The redaction process updated the newer tables, which were shown in the store’s administration dashboard. This made orders appear to have been cleared, even though personal information remained in older records.

Foundation also found customer details in refund records, abandoned shopping carts and contact forms. Some abandoned carts contained shipping information from people who never completed a purchase.

The company acknowledged that its checks had failed to detect the remaining information. “Protecting your information was still our full responsibility,” Foundation said.

Recent orders placed through Shopify may also have been exposed because automatic data deletion had not yet been activated for those records.

In its second investigation update, Foundation said attackers could have accessed records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses.

The company could not confirm whether the attackers accessed every record, so it is treating all of them as potentially exposed.

Foundation also found that more than 5,000 email addresses targeted by the phishing campaign did not appear in its WooCommerce or Shopify customer records. Some matched its support and recruitment inboxes.

This suggests the attackers may have used information from sources outside Foundation. However, the company has not confirmed where all the personal information came from. Foundation said it was rotating keys and other security credentials across its systems, taking affected older services offline and preserving evidence for the investigation.

The incident does not mean that Passport hardware wallets or the bitcoin stored through them have been compromised.

Hardware wallets are designed to keep private keys offline, away from internet-connected devices. However, phishing attacks can still put users at risk by tricking them into revealing their recovery phrases.

Foundation has advised customers not to click suspicious links or enter their recovery phrases on websites. Users should verify announcements through the company’s official website at foundation.xyz or verified X account.