Foundation, the manufacturer of the Bitcoin-only hardware wallet Passport, reported a phishing incident involving emails sent from its official domains. The messages claimed an urgent product recall due to a faulty display module and directed users to a fraudulent website, foundation.support, which mimicked the company's Envoy app to solicit Bitcoin deposits.
The company stated that the breach occurred through compromised Cloudflare API keys, which have since been revoked. Foundation confirmed that the malicious domain was taken down and emphasized that the Passport hardware itself remains secure, with no user funds compromised by this specific phishing attempt.
Despite the company's explanation, customers reported that the emails contained sensitive personal information, including full names, phone numbers, and home addresses. Users noted that the messages were sent from official addresses, such as jobs@foundation.xyz, and included details from orders placed as far back as two years ago.
Foundation has not yet confirmed whether its internal customer database was breached. While the company previously stated in 2022 that it self-hosts its marketing tools and deletes customer data 60 days after shipping, it has promised to release a full report regarding the incident in the near future.
