TL;DR:
Over 23,000 malicious email attempts were recorded, with 19,057 messages delivered via Mailgun and 1,503 through Google Workspace.
Residual database backups from its previous WooCommerce store preserved names, contact information, and shipping addresses.
The manufacturer revoked the compromised Cloudflare API keys and confirmed that Passport physical devices suffered no security compromises.
This Monday, October 26, hardware wallet manufacturer Foundation confirmed that its team is investigating a data breach after detecting more than 23,000 phishing emails targeting users.
INVESTIGATION UPDATE
Many of you have asked how personal information ended up in the phishing emails, particularly those who ordered from us years ago. Here is what we have found so far.
Phishing emails:
We have identified more than 23,000 phishing email attempts across our…
— FOUNDATION (@FoundationHQ) October 26, 2026
The incident began with the detection of fraudulent messages sent from official-looking domains. According to the report published by Foundation, more than 23,000 phishing attempts were identified across its infrastructure, of which 19,057 were delivered via the Mailgun service and 1,503 through Google Workspace.
Several recipients received multiple copies of the same email. Other dispatches were blocked before reaching users’ inboxes. The company stated in its announcement that these volumetric figures do not determine the exact number of individuals affected in its records.
The source of the exposure stems from outdated tables in its previous e-commerce platform. Prior to migrating its online store to Shopify in May 2026, the company operated on WooCommerce with a rule configured to anonymize customer data 60 days after each shipment.
In the admin panel, buyer information appeared as deleted. However, previous database migrations had duplicated the records into auxiliary tables that were not part of the primary view.
These historical backups retained names, phone numbers, email addresses, and physical shipping addresses. The exposed information also included refund requests and abandoned shopping carts from visitors who never finalized an order.
Foundation’s official documentation notes that relying on the visual status of the control panel proved to be an insufficient procedure to guarantee the purging of the underlying storage. Data from orders processed on Shopify starting in May 2026 may have also been compromised, as automated deletion tools were still in the technical development phase.
Several users reported receiving fraudulent messages containing details they claimed never to have provided to the company . The investigation is assessing whether the attackers cross-referenced these records with prior external leaks.
Compromised API Keys and Hardware Safeguards
The initial intrusion pathway was linked to network infrastructure credentials. According to the statement released on October 25, 2026, the attackers gained access to one or more Cloudflare API keys belonging to the organization.
An application programming interface key grants automated administrative permissions without requiring traditional passwords. Cloudflare manages critical routing and domain name services for online platforms.
After confirming the anomaly, the technical team proceeded to revoke all active credentials on that platform . The entity confirmed that the malicious domain used to channel the emails was taken down immediately.
The fraudulent messages attempted to deceive users into entering their recovery seed phrases on external websites. To enhance the credibility of the scam, the attackers included verified personal data from past purchases within the body of the email.
During the incident, Passport cold storage devices were not compromised. The firm emphasized that users’ private keys remain protected by the isolated architecture of its devices.
Both the Passport Core and Passport Prime models operate with air-gapped technology. This means they do not have Bluetooth connections or conventional data ports, restricting their interaction exclusively to QR codes or microSD cards.
Industry source reports recall that similar incidents have impacted manufacturers across the sector. During 2020, a vulnerability in Ledger’s e-commerce servers exposed the contact details of more than 272,000 customers, leading to ongoing extortion and phishing campaigns over several subsequent quarters.
The firm stated that it will keep legacy services disconnected while preserving digital evidence for forensic audits. The technical team will release a comprehensive final report once forensic verifications of its records are complete.
