Foundation, which makes the Passport hardware wallet, has confirmed that phishing emails sent from its official domains were traced back to compromised Cloudflare API keys.

It also said that customer records were in systems that the attackers could reach, but it has so far found no evidence that Passport devices or their private keys had been affected.

What the Investigation Has Found So Far

The company first made the public aware of what was going on in an announcement on X yesterday, saying that spam emails had been sent to users and they appeared to have come from official Foundation domains.

It further pointed out that it had traced the issue to at least one compromised API key on Cloudflare. Following that discovery, it revoked all API keys and took down the malicious domain in the spam emails.

Interestingly, only days earlier, Foundation had cautioned followers on the social platform that their email accounts were likely to be their “single biggest point of failure” as far as their digital security was concerned. It advised users to secure their emails with strong and unique passwords, as well as to use different addresses for important accounts and have passkeys or authentication backed by hardware whenever available.

In a new update on the incident this morning, the firm shared that it had identified more than 23,000 phishing email attempts across its email systems, with about 19,000 messages sent through Mailgun and just over 1,500 via Google Workspace. According to them, some of the addresses got several messages, while other attempts failed or were stopped before they could be delivered.

Per Foundation’s initial investigation, order records from a service it had used in the past, WooCommerce, had survived database migration, even though customer records were supposed to be redacted 60 days after shipping. Apparently, the process updated newer tables shown in the store dashboard while copies stayed in older tables, while at the same time there were additional details that had persisted in refund records, abandoned carts, and contact forms.

However, 5,000 addresses that received phishing emails did not appear in Foundation’s WooCommerce records or those of the platform it moved to, Shopify. To be safe, the wallet maker said it is rotating keys across its system, even those it isn’t sure were accessed. It is also keeping offline a copy of the legacy WooCommerce data for investigators to use but will delete it permanently once investigations are completed.

“We have found no evidence that this incident compromised Passport devices or the private keys they hold,” the company wrote.

Other Wallet Makers Have Dealt With Similar Leaks

The last few months have seen several crypto wallet makers on the wrong end of data breaches, starting in August with ShipMonk, a Trezor provider that saw the information of more than 67,000 users of the wallet stolen, including their names, cities, and emails.

In October, on-chain researchers said that as much as $80 million worth of crypto may have been stolen from Ledger users who had bought their hardware wallets from an authorized reseller in Southeast Asia, CryptoBilis, with at least one affected wallet containing an unauthorized implant.

And just a day before Foundation came forward, Keystone Wallet, another major provider, reported a security issue of its own. According to the company, on October 20, unauthorized people accessed its official website and obtained customer shipping information such as their shipping addresses and the products they had bought. It, however, stated that wallet passwords and private keys were not compromised. Keystone also added that bank information and payment card details of its users were likewise safe.

The post Passport Wallet Maker Foundation Reports Customer Data Exposure appeared first on CryptoPotato.