Foundation API Breach Enables Sophisticated Phishing Attacks

The security incident, disclosed by Foundation on October 26, began when attackers gained entry to the company’s backend infrastructure through a vulnerability in a self-hosted application. By hijacking Cloudflare API keys, the perpetrators bypassed standard phishing red flags, allowing malicious messages to arrive with the perceived authority of the company’s legitimate email infrastructure. CEO Zach Herbert confirmed that the intrusion likely granted the attackers access to the customer support inbox, potentially exposing sensitive personal details like phone numbers and mailing addresses.

Foundation managed to revoke the compromised credentials and disable the unauthorized email activity within 10 minutes of initial user reports. Despite the breach of communication channels, the company maintains that the integrity of the Passport hardware wallet remains intact, as the devices are designed to keep private keys isolated from internet-connected systems. The investigation is currently working to determine the precise extent of the data exposure, specifically how the attackers obtained customer contact information. Users are advised to exercise extreme caution with any correspondence, as the company has not yet provided a definitive list of impacted individuals or confirmed if recovery phrases were targeted.