# Foundation Passport hardware wallet security breach

> Developing situation record from CLSTR: https://clstr.news/situations/foundation-passport-hardware-wallet-security-breach
> Updated: 2026-10-27T06:20:35.000Z. Sources: 9. Developments: 2.

A security incident at Foundation, the manufacturer of the Passport Bitcoin hardware wallet, resulted in the compromise of its email infrastructure and customer data. Attackers gained access to the company’s customer support inbox through compromised Cloudflare API keys and a vulnerability in a self-hosted application.

The breach led to the distribution of phishing emails, with reports indicating approximately 23,000 phishing attempts were sent via services such as Mailgun and Google Workspace. These fraudulent messages often used the guise of product recalls to target users. While customer records, including names, addresses, and phone numbers, were potentially exposed—including legacy data from a previous WooCommerce setup—Foundation stated there is no evidence that Passport hardware devices or private keys have been affected.

## Timeline

### 2026-10-27: Foundation reports data exposure and 23,000 phishing emails

Foundation, maker of the Passport hardware wallet, reported over 23,000 phishing emails following a breach of its Cloudflare API keys and backend infrastructure. No private keys were compromised.

3 sources. https://clstr.news/cluster/foundation-reports-data-exposure-and-23000-phishing-emails

### 2026-10-26: Phishing campaigns target organizations and hardware wallet users

Global phishing campaigns are targeting 40,000 organizations via fake Microsoft Teams invites, while the Foundation hardware wallet manufacturer reports a data breach affecting customer contact info.

6 sources. https://clstr.news/cluster/phishing-campaigns-target-organizations-and-hardware-wallet-users

---
Cite as: Foundation Passport hardware wallet security breach. CLSTR, https://clstr.news/situations/foundation-passport-hardware-wallet-security-breach