Foundation faces data privacy questions after Cloudflare API key compromise — Details

Foundation is under scrutiny for a potential customer data protection breach. The company known for making Bitcoin Hardware wallets just reported that it had become a victim of spam email attacks that seemed to have originated from their official domains.

According to Foundation’s announcement on their official X page, the suspicious emails were traced to one or more compromised Cloudflare API keys. The company stated it had revoked all affected API keys and taken down the malicious domain associated with the spam campaign.

Foundation also reassured users about the security of their Bitcoin assets. However, the response has not fully addressed questions about the possible exposure of personal information, particularly among customers who had previously requested data deletion.

Users question how attackers obtained personal data

Many user expressed their disappointment and raise questions about the incident.

To start with, Jerry Gensler expressed his displeasure after discovering that a phishing email still contained his personal information despite previously requesting its deletion.

I’m a little disappointed here. I took the time to email you guys asking to have any and all of my personal data deleted from Foundation’s end. I was replied to on a burner email account that I’d provided for confirmation, and given assurances that all my personal data was deleted from Foundation’s end for good. I am confused how this phishing email still accurately has all of my personal info included?

Another user, Joe Turner of Arise Bitcoin, raised broader questions about the incident. He specifically asked how attackers obtained customers’ names, residential addresses, phone numbers, and delivery details.

How did the attackers obtain customers’ names, residential addresses, phone numbers and delivery details? Compromised Cloudflare API keys alone do not explain this. Has your customer database been breached, and what evidence do you have to rule that out?

The list is long, but their cumulative reactions highlighted an important distinction that compromising infrastructure credentials does not, by itself, establish that attackers accessed customer records.

Even so, the apparent accuracy of the personal information has intensified scrutiny of Foundation’s data protection practices.

What does the incident mean for Bitcoin hardware wallets security?

The incident highlights the difference between protecting Bitcoin funds and safeguarding customer data. While phishing emails do not automatically expose wallet keys, leaked personal information can make scams more convincing.

Foundation must investigate how attackers obtained the data, determine whether they accessed customer records, and address users’ concerns to restore confidence.

Final Summary

• Foundation revoked compromised Cloudflare API keys and reported taking down the malicious domain linked to spam emails.
• Incident raises concerns about customer privacy, phishing risks, and the distinction between personal data security and their Bitcoin asset protection.