By Foundation, the manufacturer of the Passport Bitcoin hardware wallet, has identified more than 23,000 phishing email attempts following a security incident involving compromised infrastructure credentials and potentially exposed customer information.
In an October 26, 2026 investigation update, the company reported 19,057 phishing messages delivered through Mailgun and another 1,503 sent through Google Workspace.
Some recipients received multiple messages, while other attempts were blocked or failed before delivery. Foundation emphasized that the figures do not represent 23,000 individual victims, and the number of people whose personal information was exposed remains undetermined.
The incident emerged after customers reported suspicious emails appearing to originate from Foundation’s official domains, some containing accurate names, addresses and purchase information.
Foundation said its Passport hardware wallets and the private keys stored on them had not been compromised.
Compromised Credentials and Legacy Customer Records
Foundation initially disclosed the incident on October 25, attributing the fraudulent emails to one or more compromised Cloudflare application programming interface keys. The company revoked the affected credentials and removed the malicious website referenced in the messages.
Chief executive Zach Herbert subsequently said attackers had exploited a vulnerability in a self-hosted application, compromising portions of the company’s backend infrastructure. The attackers may also have accessed Foundation’s customer support inbox.
Further investigation revealed problems with the company’s historical customer-data retention procedures. Before migrating to Shopify in May 2026, Foundation operated its online store using WooCommerce. Its systems were configured to redact customer information 60 days after orders shipped.
However, earlier database migrations had copied order information into newer tables while leaving duplicate records in older tables. The redaction process updated the newer records visible through the store’s administrative dashboard but failed to remove information from the legacy tables.
Consequently, older records continued containing customer names, contact information and shipping addresses. Additional personal information remained in refund records and abandoned shopping carts, including details submitted by customers who never completed purchases.
Foundation acknowledged that relying on the administrative dashboard’s redaction status had been insufficient to verify permanent deletion. The company is also investigating whether orders placed through its newer Shopify store since May were exposed.
Phishing Campaign Targeted Wallet Recovery Phrases
The fraudulent emails impersonated Foundation security communications and warned recipients that their Passport devices or funds were at risk. Some messages referred to an urgent hardware recall and directed users to an external website designed to obtain wallet recovery phrases.
The inclusion of accurate personal information made the messages more convincing, particularly when they appeared to originate from legitimate company email infrastructure. Unlike ordinary spam, these attacks targeted individuals associated with cryptocurrency self-custody products.
A recovery phrase provides access to the private keys controlling a cryptocurrency wallet, meaning disclosure can allow attackers to transfer funds without possessing the physical device. Foundation stated that it found no evidence of compromised Passport devices or private keys.
However, it has not established whether any recipients disclosed recovery phrases or suffered financial losses after interacting with the phishing messages. The company revoked affected email credentials, cleared queued fraudulent messages and disabled compromised legacy services while preserving evidence. Foundation is reviewing historical support records and investigating reports that some phishing emails contained personal details recipients claimed never to have shared with the company.
It has not confirmed whether information from unrelated security breaches was incorporated into the campaign. The incident follows similar customer-information concerns involving hardware wallet manufacturer Keystone earlier in October.
Both cases highlight the distinction between protecting cryptocurrency private keys and securing personal information collected through online retail operations. Foundation has promised a comprehensive incident report once its investigation concludes.
Until then, the full scope of customer-data exposure, the attackers’ access and any resulting financial losses remain unconfirmed.