Foundation hit by 23,000 phishing emails – Legacy database may be exposed

Foundation, the company behind the Passport hardware wallet, has reported a security incident that happened on the 26th of November.

Here, the attackers sent more than 23,000 phishing email attempts using emails that appeared to come from official Foundation domains.

These emails were designed to trick users into revealing their wallet recovery phrases, which gave attackers access to the cryptocurrency stored in their wallets.

Foundation took to X and noted,

These numbers do not tell us how many people had personal information exposed. We are still determining that number and will share it once we can confirm it.

This is because some emails were sent multiple times or blocked before delivery.

How did the attackers orchestrate this?

The investigation further revealed that the attackers may have accessed personal information stored in Foundation’s old WooCommerce store and its current Shopify store.

For context, Foundation previously used WooCommerce before migrating to Shopify in May. Although the company had configured its system to redact customer information 60 days after an order was shipped, older copies of the records remained in legacy database tables following migrations.

Though the admin dashboard showed the information as redacted, the underlying data had not been completely removed. In fact, there is a possibility that other records, including refunds, abandoned carts, and contact forms, may also have retained personal information.

More revelations

Additionally, in its second investigation update, Foundation disclosed that records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were stored in systems accessible to the attackers.

However, the company cannot confirm whether every record was accessed, so it is treating all potentially accessible information as exposed.

Now what’s shocking here is that more than 5,000 email addresses that received phishing messages were not found in its WooCommerce or Shopify customer records. This means that attackers may also have obtained information from external sources.

Steps taken by the Foundation

As of now, Foundation has revoked compromised API keys and affected email credentials. Moreover, it has also removed the malicious domain, cleared queued phishing messages, and taken affected legacy services offline.

At the same time, it is also rotating keys and secrets across its systems as a precaution. But what’s interesting here is that Foundation has found no evidence that Passport hardware wallets or the private keys stored on them were compromised.

This coincided with the FBI recently announcing “Operation Blackout.” According to AMBCrypto’s previous report, this is a coordinated crackdown on international scam compounds that target Americans through fake investment platforms, online impersonation, and other fraud schemes.

Final Summary

• The investigation revealed that the attackers may have accessed personal information stored in Foundation’s old WooCommerce store and its current Shopify store.
• Still, Foundation found no evidence that Passport hardware wallets or the private keys stored on them were compromised.