Foundation's Passport hardware wallet suffered a data breach exposing customer information, leading to 23,000+ phishing email attempts targeting users' recovery phrases.
Security & Exploits ·
Foundation, maker of the Passport hardware wallet, identified more than 23,000 phishing email attempts targeting its users following a data breach. The phishing campaign delivered 19,057 messages through Mailgun and 1,503 via Google Workspace, aiming to extract wallet recovery phrases from recipients. The total number of affected users has not been disclosed.
The breach stemmed from personal information persisting in legacy WooCommerce database tables despite appearing redacted in the administrative interface. Customer data from Shopify orders placed since May may also have been exposed. Foundation has revoked compromised email credentials and taken the affected legacy services offline in response.
The company stated that no evidence exists of compromise to Passport devices themselves or their private keys. However, the scale of phishing attempts and the scope of potentially exposed customer data—particularly the timeline uncertainty around Shopify records—leave open questions about how many users may face ongoing social engineering risk.