Foundation, the company behind the Passport hardware wallet, has reported a security incident that occurred on November 26. Attackers sent more than 23,000 phishing email attempts using addresses that appeared to come from official Foundation domains. The emails were designed to trick users into revealing their wallet recovery phrases, which would give attackers access to the cryptocurrency stored in their wallets.
In a statement on X, Foundation noted that the number of phishing emails does not indicate how many individuals had personal information exposed. The company is still determining that number and will share it once confirmed, as some emails were sent multiple times or blocked before delivery.
Investigation Findings
The investigation revealed that attackers may have accessed personal information stored in Foundation’s old WooCommerce store and its current Shopify store. Foundation previously used WooCommerce before migrating to Shopify in May. Although the company had configured its system to redact customer information 60 days after an order was shipped, older copies of the records remained in legacy database tables following migrations. The admin dashboard showed the information as redacted, but the underlying data had not been completely removed. Other records, including refunds, abandoned carts, and contact forms, may also have retained personal information.
In a second investigation update, Foundation disclosed that records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were stored in systems accessible to the attackers. The company cannot confirm whether every record was accessed, so it is treating all potentially accessible information as exposed.
Notably, more than 5,000 email addresses that received phishing messages were not found in Foundation’s WooCommerce or Shopify customer records, suggesting that attackers may have obtained information from external sources.
Response and Impact
Foundation has revoked compromised API keys and affected email credentials. It has also removed the malicious domain, cleared queued phishing messages, and taken affected legacy services offline. As a precaution, the company is rotating keys and secrets across its systems.
Foundation has found no evidence that Passport hardware wallets or the private keys stored on them were compromised.
The incident coincided with the FBI’s recent announcement of “Operation Blackout,” a coordinated crackdown on international scam compounds that target Americans through fake investment platforms, online impersonation, and other fraud schemes.
