2026 Foundation (Passport wallet) — Cloudflare API keys compromised; legacy customer records exposed; 23,000+ phishing emails logged
Data compromised
Names, contact details and shipping addresses held in legacy WooCommerce database copies, plus refund records and incomplete checkout data from the old tables. Recent Shopify orders may also be involved. The company says there is no evidence that Passport devices or their private keys were affected.
Technical writeup
Foundation disclosed the incident late on October 25 (US Eastern) through a post on X, as reported by press coverage; the post itself was not retrieved. More than 23,000 phishing attempts were logged (19,057 via Mailgun, 1,503 via Google Workspace), which is not a customer count. The emails posed as an urgent Passport recall and pointed to a lookalike Envoy app page seeking recovery phrases. One outlet says the firm has not confirmed a database breach, so the wording is treated as the company’s own disclosure of customer-record exposure. companyConfirmed true.
Root cause
One or more compromised Cloudflare API keys were used to send phishing emails from Foundation’s own domains. The company says it has revoked every key and taken down the malicious domain. Coverage disagrees on the entry point; one outlet reports the CEO said the customer support inbox was reached through a flaw in a self-hosted app. A full report was promised.