Foundation: Phishing Email Attack Involved Over 23,000 Sending Attempts, Personal Information from Some Historical Orders May Have Been Leaked

TechFlow reported that on October 27, according to an official announcement from Foundation, the team investigated a recent phishing email incident and found that their email system logged over 23,000 phishing email sending attempts. Of these, 19,057 were sent via Mailgun, and 1,503 were sent via Google Workspace. Since some email addresses received multiple messages and some sending attempts failed or were blocked, the exact number of affected individuals cannot currently be confirmed.

The investigation revealed that during a database migration, FOUNDATION's previously used WooCommerce store still retained partial customer personal information in old data tables, despite the backend indicating that relevant orders had undergone data desensitization. Additionally, certain refund records, abandoned shopping carts, and order data migrated to Shopify in May may also have been compromised, with the precise scope of the leak still under investigation.

FOUNDATION stated that compromised email credentials have been revoked, pending phishing emails have been purged, and related legacy systems have been taken offline to preserve evidence. Currently, there is no evidence indicating that this incident affected Passport hardware devices or any private keys stored within them. Officials advise users never to enter or disclose wallet recovery phrases on the website or to anyone, and a full report will be published once the investigation concludes.

In prior reporting, Bitcoin hardware wallet developer Foundation noted that spam disguised as messages from its official domain had recently circulated. The team's tracking traced the incident to potentially one or more leaked Cloudflare API keys. All related API keys have been revoked, and the malicious domains referenced in the emails have been shut down.