Foundation Wallet Phishing Exposes Customer Data

| cryptopotato.com
Foundation, maker of the Passport Bitcoin hardware wallet, said phishing emails sent from its official domains followed a breach of its backend systems. The company initially said attackers had compromised Cloudflare API keys and may have accessed its customer support inbox through a vulnerability in a self-hosted app. It warned that some emails included personal details and urged users never to share recovery phrases; Passport devices and funds were reported safe. In a later update, Foundation identified more than 23,000 phishing email attempts—about 19,000 through Mailgun and just over 1,500 through Google Workspace, with some messages blocked or undelivered. Its investigation found customer information in legacy WooCommerce data, including older database tables and records related to refunds, abandoned carts and contact forms. Foundation is rotating system keys and preserving an offline copy of the legacy data for investigators. It has found no evidence that Passport devices, private keys or funds were compromised, but the Foundation phishing incident increases the risk of follow-up scams targeting customers. The company has not disclosed the number of affected customers and said it would publish a formal incident report.
Neutral
The incident has no confirmed direct effect on Bitcoin’s protocol, network activity or market supply, and Foundation says it has found no evidence that Passport devices, private keys or funds were compromised. As a result, an immediate Bitcoin price reaction is likely to be limited; the news is primarily a customer-data and wallet-security concern rather than a Bitcoin-specific market catalyst. In the short term, traders may respond to broader concerns about phishing and hardware-wallet security, particularly if further customer exposure or fund losses are reported. That could briefly weigh on sentiment, but the current information does not establish a direct threat to BTC holdings. Over the longer term, the incident may reinforce demand for stronger security practices and self-custody awareness, without pointing to a sustained change in Bitcoin’s price outlook. The assessment could change if investigators confirm stolen recovery phrases, compromised funds or wider wallet vulnerabilities.