Email Infrastructure Targeted in Coordinated Phishing Campaign

FOUNDATION, the developer behind the popular Passport hardware wallet, recently notified the community of a security incident. An internal investigation revealed that its corporate email systems were subjected to a substantial phishing campaign. Logs recorded more than 23,000 attempts to send malicious emails to various addresses.

Breakdown of Attack Vectors and Mitigation

A detailed analysis showed 19,057 attempts routed through the Mailgun service, with an additional 1,503 originating from Google Workspace. The exact number of impacted individuals remains unclear, as some addresses were targeted multiple times and a portion of the attempts were blocked by security filters. This event underscores the persistent threats facing corporate communication channels.

Legacy Data Exposure Discovered During Platform Migration

Separately, the company's review uncovered a potential data exposure issue linked to a past e-commerce platform migration. The investigation centered on its former WooCommerce store.

Residual Data in Old Database Tables

During the transition to a new system, it was discovered that legacy database tables might not have been fully purged. While administrative panels indicated customer order data had been anonymized, the original tables potentially retained certain personal information.

The scope of potentially affected data includes:

  • Some refund transaction records
  • Abandoned shopping cart information
  • Certain order data from the early period after migrating to Shopify in May of this year

The company stated that an investigation is ongoing to determine the extent of the exposure and whether any data was accessed maliciously.

Core Hardware Integrity Confirmed, User Funds Secure

Critically, FOUNDATION emphasized that there is no evidence this incident compromised the security of the Passport hardware wallets or the private keys they store.

The design of hardware wallets inherently keeps private keys isolated within a secure element, disconnected from online servers. This architecture played a vital role in protecting user assets throughout this event. The security of cryptocurrencies depends on the physical device, not the company's web infrastructure.

Users are advised to remain vigilant against phishing emails requesting recovery phrases, private keys, or passwords, and are reminded that the company will never ask for such information via email.