Foundation Finds 23,000 Phishing Attempts Tied to Exposed Customer Data

Foundation identified more than 23,000 phishing email attempts linked to exposed customer information, raising concerns for Passport Bitcoin wallet users. In an October 26 update, the company said an older store system may have exposed customers’ names, addresses and contact details.

The incident involved compromised Cloudflare API keys, which Foundation revoked. The company reported 19,057 emails delivered through Mailgun and 1,503 through Google Workspace. These figures do not establish how many customers were affected.

Legacy Store Records Exposed Customer Data

Foundation traced part of the exposure to its former WooCommerce store, replaced by Shopify in May 2026. The company said its data removal process covered newer database tables but left older copies intact.

Related: Electrum Fixes Bitcoin Wallet Flaw Exploited by Malicious Servers

The records may have included names, shipping addresses and contact details linked to orders, refunds and abandoned carts. Foundation is also investigating historical Shopify and customer support records.

Passport Devices Remain Secure

Foundation said it found no evidence that attackers accessed Passport devices or stole private keys. However, phishing emails used customer information to appear legitimate and potentially trick recipients into revealing wallet recovery phrases.

The company cleared queued emails, disabled affected legacy services and preserved evidence for its investigation. It also reminded users never to share their recovery phrases while work to determine the incident’s full scope continues.

Related: CoinDCX Confirms $16M Loss After Failed Wallet Sweeping System Exposed Deposits