Foundation reports data exposure and 23,000 phishing emails

Foundation, the manufacturer of the Passport Bitcoin hardware wallet, has confirmed a security incident involving compromised infrastructure credentials. The company identified more than 23,000 phishing email attempts, with approximately 19,000 messages sent via Mailgun and over 1,500 via Google Workspace.

The breach was traced back to compromised Cloudflare API keys and a vulnerability in a self-hosted application that allowed attackers to access portions of the company’s backend infrastructure. While customer records were stored in systems accessible to the attackers, Foundation stated there is currently no evidence that Passport hardware devices or the private keys stored on them have been affected.

Investigation into the incident revealed that attackers may have accessed the company’s customer support inbox. The breach also highlighted issues with historical data retention; while the company migrated to Shopify in May 2026, legacy data from its previous WooCommerce setup was potentially exposed. The exact number of individuals whose personal information was compromised remains undetermined.