FOUNDATION Report on Self-Hosted System Vulnerability Leading to Credit Card Information Leak

FOUNDATION released a security incident review report for October, stating that attackers exploited a code execution vulnerability in its self-hosted Cal.com appointment system to breach the server, steal multiple service credentials, access customer records, and send phishing emails. The earliest unauthorized activity dates back to October 21, with phishing emails attempted to be sent over 23,000 times, involving 21,463 email addresses. The leaked information includes names, email addresses, mailing addresses, phone numbers, order details, historical customer service records, as well as partial credit card information such as cardholder names, the last four digits of card numbers, and expiration dates; complete card numbers were not leaked. Users have reported receiving scam calls impersonating FOUNDATION customer service, with scammers accurately stating order information and the last four digits of credit cards. FOUNDATION stated that funds stored in Passport are secure, and there are no plans to recall or replace devices, nor will users be asked to provide mnemonic phrases. The company plans to migrate self-hosted services to managed infrastructure and tighten access permissions for various applications.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.