Security Breach at Hardware Wallet Maker Exposes Customer Data

A prominent hardware wallet manufacturer, Foundation, has confirmed a sophisticated breach of its internal systems. Public reports detail an attack that went beyond a simple data leak, involving multiple stages of exploitation.

The Path of the Attack

The intrusion began when attackers exploited a vulnerability in the company's self-hosted appointment scheduling software. After gaining an initial foothold, they leveraged another flaw in a separate open-source tool to steal credentials for broader system access.

With these credentials, the hackers accessed several critical areas:

  • Customer records containing order history and support communications
  • The corporate email system used for official correspondence
  • Domain configuration settings, potentially compromising website legitimacy

Scale and Methods of the Phishing Campaign

The breach started in late October. Within days, the attackers escalated their operations. They sent phishing emails to a list of 21,463 customer addresses, and crucially, these emails originated from Foundation's genuine email servers, making them far more deceptive.

The scope of the compromised data was significant, including:

  • Customer names, physical addresses, and phone numbers
  • Detailed purchase records and support ticket histories
  • Partial payment card information

The attackers didn't stop at email. Reports indicate they used the stolen purchase information to place phone calls to customers, impersonating support staff in attempts to extract Bitcoin wallet recovery phrases.

Impact and Company Response

In its disclosure, Foundation stressed that funds stored on its Passport hardware devices remain secure, as private keys are generated and stored offline on the user's device. The company also stated that employee accounts and devices were not compromised.

As a direct result of the incident, Foundation announced a strategic shift away from self-hosted infrastructure, planning to migrate key services to managed third-party providers to strengthen its security perimeter.

This event serves as a critical reminder for all cryptocurrency users to treat any request for a recovery phrase or private key with extreme suspicion, regardless of how official it may appear.