Passport Bitcoin hardware wallet developer Foundation: Passport phishing email investigation finds over 23,000 attempts
On October 26, Foundation released an update on its security incident investigation, saying it had discovered more than 23,000 phishing email sending attempts, of which 19,057 were delivered via Mailgun and 1,503 were sent via Google Workspace. Some emails were not successfully delivered, and the number of actually affected users is still under investigation; the company said it will announce it after confirmation.
The investigation found that when Foundation previously used WooCommerce, it had configured customer information to be automatically anonymized 60 days after shipment. The backend showed that orders had been anonymized, but after the database migration, the old data tables still retained personal information; similar issues also existed in refund records and shopping carts for unfinished orders. Customer information for new orders after the migration to Shopify in May this year may also have been leaked, and the relevant orders have not yet been manually anonymized. Foundation said it has revoked the affected email credentials, cleared phishing emails from the queue, and shut down related legacy services. There is currently no evidence that Passport devices or the private keys in them were affected.
The company pointed out that the phishing emails were intended to trick users into revealing recovery phrases, and contained correct personal information to increase credibility. Foundation reminded users never to enter recovery phrases on websites or share them with anyone, including people claiming to be from Foundation. The investigation is still ongoing, and the full report will be released after completion.
Original source:
Title: INVESTIGATION UPDATE Publisher: FOUNDATION (@FoundationHQ) Publication date: 2026-10-26 URL: https://x.com/FoundationHQ/status/2114743519852069110 Source nature: original post by the party involved Verification status: full text actually read in this report, verification date 2026-10-26 Supporting content: supports more than 23,000 phishing email attempts (19,057 via Mailgun, 1,503 via Google Workspace), some not delivered, number of affected users still being confirmed; personal information remaining in old WooCommerce tables, issues in refunds and unfinished carts, and possible leakage in new Shopify orders; credentials revoked and legacy services shut down; no evidence that Passport devices or private keys were affected; and an explanation that the phishing emails were used to trick users into revealing recovery phrases.
ABAB AI Insight
Foundation is the developer of the Passport Bitcoin hardware wallet, whose product is designed around offline private key storage. This incident involves customer information leakage from the e-commerce backend and email system, rather than the device firmware or the keys themselves. CEO Zach Herbert previously said that attackers entered the backend through a self-hosted application vulnerability and may have accessed the customer support inbox, then used a leaked Cloudflare API key to send emails from the official domain.
In terms of the data path, orders from the WooCommerce period showed as anonymized in the backend, but the old tables were not cleared during migration, allowing attackers to access historical names, addresses, and contact information. New orders after the Shopify migration likewise lacked an immediate automatic deletion mechanism. This situation, in which the front end shows that something has been handled while the underlying data still remains, allowed the phishing emails to carry real personal information and increase the success rate. Foundation has shut down the related legacy services and preserved evidence, but the full scope of the impact remains to be confirmed.
Customer data leaks at hardware wallet makers have occurred many times before, for example when some brands experienced targeted phishing after their mailing addresses were exposed. Unlike attacks aimed only at private keys, such incidents exploit supply-chain and after-sales data, using emails with an “official-looking” appearance as the entry point. The conclusion that Passport itself was not affected is based on the current investigation having found no evidence that the device or private keys were touched, but users still face social engineering risks.
This update clarified the scale of the email sending and the data residue mechanism, changing Foundation’s view of the effectiveness of historical order anonymization. For users, real personal information entered into phishing emails increased the feasibility of tricking them into revealing recovery phrases; for the company, incomplete data cleanup after the e-commerce system migration became a concrete path that attackers could exploit.
ABAB News · Cognitive Law
Data shown as anonymized in the backend does not mean the underlying data tables have been cleared.
When real personal information enters emails from an official domain, tricking users into revealing recovery phrases becomes more likely to succeed.