Foundation Says Phishing Emails Included Some Customer Details

Attackers exploited a flaw in an application Foundation operated and reached part of its backend, then sent phishing emails that appeared to come from the company’s official domains, some containing customer contact details.

Some emails included mailing addresses or phone numbers, the company said. Attackers were likely able to access Foundation’s customer support inbox, but the company has not confirmed how the details were obtained or how many people received the messages.

Foundation said it shut down the email-sending access within 10 minutes after the first reports and removed the attackers from its systems. Its initial notice linked the campaign to one or more compromised Cloudflare API keys; the company also said it revoked the keys and took down the malicious domain.

Foundation said its Passport hardware wallets and the funds stored on them were not compromised. Passport is the company’s Bitcoin hardware wallet. Foundation is investigating whether information came from support inbox access, recent data leaks or recent Shopify orders; it has not confirmed any of those as the source.