Passport Wallet Maker Foundation Reports Customer Data Exposure

Foundation, the company behind the Passport hardware wallet, has confirmed that phishing emails sent from its official domains were traced back to compromised Cloudflare API keys.

The company stated that customer records were located in systems accessible to the attackers, but it has found no evidence that Passport devices or their private keys were affected.

What the Investigation Has Found So Far

The company first alerted the public to the incident in an announcement on X yesterday, noting that spam emails had been sent to users and appeared to originate from official Foundation domains.

It further explained that the issue was traced to at least one compromised API key on Cloudflare. Following this discovery, the company revoked all API keys and took down the malicious domain used in the spam emails.

Notably, just days earlier, Foundation had warned followers on the social platform that their email accounts were likely their “single biggest point of failure” regarding digital security. The company advised users to secure their emails with strong, unique passwords, use different addresses for important accounts, and utilize passkeys or hardware-backed authentication whenever available.

In a new update on the incident this morning, the firm reported that it had identified more than 23,000 phishing email attempts across its email systems. Approximately 19,000 messages were sent through Mailgun, and just over 1,500 via Google Workspace. According to the company, some addresses received multiple messages, while other attempts failed or were stopped before delivery.

According to Foundation’s initial investigation, order records from a previously used service, WooCommerce, survived database migration even though customer records were supposed to be redacted 60 days after shipping. It appears the process updated newer tables shown in the store dashboard, while copies remained in older tables. Additionally, extra details persisted in refund records, abandoned carts, and contact forms.

However, 5,000 addresses that received phishing emails did not appear in Foundation’s WooCommerce records or those of the platform it migrated to, Shopify. To be safe, the wallet maker is rotating keys across its system, including those it is unsure were accessed. It is also keeping an offline copy of the legacy WooCommerce data for investigators to use but will delete it permanently once investigations are completed.

“We have found no evidence that this incident compromised Passport devices or the private keys they hold,” the company wrote.

Other Wallet Makers Have Dealt With Similar Leaks

The last few months have seen several crypto wallet makers fall victim to data breaches, starting in August with ShipMonk, a Trezor provider that saw the information of more than 67,000 users stolen, including their names, cities, and emails.

In October, on-chain researchers reported that as much as $80 million worth of crypto may have been stolen from Ledger users who purchased their hardware wallets from an authorized reseller in Southeast Asia, CryptoBilis. At least one affected wallet contained an unauthorized implant.

And just a day before Foundation came forward, Keystone Wallet, another major provider, reported its own security issue. According to the company, on October 20, unauthorized individuals accessed its official website and obtained customer shipping information, such as shipping addresses and purchased products. The company stated that wallet passwords and private keys were not compromised. Keystone also added that users’ bank information and payment card details remained safe.