Passport wallet phishing attempts exceeded 23,000 after attackers compromised infrastructure credentials at hardware wallet maker Foundation. The company said its devices and their stored private keys had not been compromised, but it has not determined how many people had personal information exposed.

Key Takeaways

  • Foundation identified 19,057 phishing messages delivered through Mailgun and 1,503 through Google Workspace; some other attempts were blocked or failed.
  • The campaign sought wallet recovery phrases, and some messages included accurate customer details.
  • Foundation is investigating the scope of data exposure and has not confirmed whether recipients lost funds.

How the Passport wallet phishing campaign worked

In its October 26, 2026 investigation update, Foundation said the more than 23,000 attempts did not represent the same number of individual victims: some recipients received multiple messages.

The fraudulent emails impersonated Foundation security communications. Some warned of an urgent hardware recall and directed recipients to a website designed to obtain wallet recovery phrases. A recovery phrase gives access to the private keys controlling a wallet, so someone who obtains it can transfer funds without the physical device.

Foundation said it found no evidence that Passport devices or private keys were compromised. It has not established whether recipients disclosed recovery phrases or suffered financial losses.

Legacy customer records remained accessible

Foundation initially disclosed the incident on October 25, attributing the fraudulent emails to compromised Cloudflare application programming interface keys. Chief executive Zach Herbert subsequently said attackers exploited a vulnerability in a self-hosted application and compromised parts of Foundation’s backend infrastructure. The attackers may also have accessed the customer support inbox.

The investigation found that older records containing names, contact information and shipping addresses had remained in legacy database tables despite a process intended to redact customer information 60 days after orders shipped. Information also remained in refund records and abandoned shopping carts, including details from people who did not complete purchases.

Foundation said earlier database migrations left duplicate order records in older tables, while the redaction process updated newer records visible in the store’s administrative dashboard. The company is also investigating whether orders placed through its Shopify store since May 2026 were exposed.

Foundation’s response and open questions

Foundation revoked affected credentials, removed the malicious website, cleared queued fraudulent messages and disabled compromised legacy services while preserving evidence. It is reviewing historical support records and reports that some phishing emails included personal details recipients said they had not shared with the company.

The company has not confirmed whether information from unrelated breaches was used in the campaign. The full extent of customer-data exposure, attacker access and any financial losses remains unknown.

Next milestone

Foundation has promised a comprehensive incident report once its investigation concludes.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.