Overview
- Foundation, which announced the issue on Oct. 26, traced fraudulent emails to one or more compromised Cloudflare API keys and revoked those keys while taking down the malicious domain.
- CEO Zach Herbert said attackers likely exploited a vulnerability in a self‑hosted application and may have gained access to parts of Foundation’s backend, including the customer support inbox.
- Recipients reported that the phishing messages included real names, shipping addresses and past purchase details and a former job applicant outside the customer base also received one of the emails.
- Foundation says Passport hardware and the funds stored on it were not technically breached but warned users that authentic-looking emails and exposed personal data raise a high risk of social‑engineering attacks that can lead to stolen recovery phrases.
- The company has not disclosed how many people were targeted or whether any recovery phrases were obtained and has pledged a formal incident report as its investigation continues, a development that follows other recent wallet-related phishing and data‑exposure incidents.