Hardware-wallet maker Foundation disclosed on Oct. 25 that compromised Cloudflare API keys let attackers send phishing emails that appeared to come from its official domains. The messages falsely warned Passport owners of a recall and directed them to a fake site that sought recovery phrases or fund transfers. Foundation said Passport hardware was not compromised and funds stored on the devices remained safe. It said it revoked the keys, disabled the malicious domain and blocked further unauthorized emails; its CEO said it acted within 10 minutes of user reports.
Some emails contained accurate customer details, including addresses and past purchases. The CEO said a vulnerability in a self-hosted app had compromised some backend infrastructure and that attackers likely accessed the customer-support inbox. Foundation had not established the full extent of the exposure or said how many people received the emails.
