Foundation reportedly disclosed a customer-data breach and phishing incident affecting Passport wallet users. The customer-facing campaign, around October 25, 2026, was linked to more than 23,000 phishing-email sending attempts targeting 21,463 email addresses. Later media reports on a Foundation alert said Passport hardware had not been compromised and funds stored on Passport remained safe, although accounts differ on the technical entry point.

What Was Reportedly Exposed in the Foundation Incident

Reports say the incident exposed customer contact and order-related data, including names, addresses, phone numbers, order histories, and partial payment-card information. The same reporting links the data to a phishing campaign targeting 21,463 email addresses, involving more than 23,000 email-sending attempts.

The two figures do not appear to measure the same thing. The larger figure refers to reported sending attempts, while 21,463 appears to refer to targeted email addresses. This distinction matters because it does not necessarily mean every sending attempt involved a different person or that every attempted email was delivered.

The reported payment-card exposure should also be interpreted narrowly. The supplied reporting refers to partial payment-card information, not complete card credentials, and does not specify which fields were included.

Were Passport Wallet Funds at Risk?

The reported company position is no. The supplied alert and later media snippets describing Foundation statements say Passport hardware was not compromised and that funds stored on Passport were safe.

That is the key distinction for users: the reported risk was not a remote compromise of the hardware wallet itself, but impersonation. The same reporting says attackers used customer and order information in phishing emails and phone-based social-engineering attempts seeking Bitcoin recovery phrases.

In practical terms, the loss scenario described here involves users being deceived into disclosing sensitive wallet recovery information, rather than a direct takeover of a Passport device in the reported incident. The supplied material does not support claims that Foundation stored seed phrases or that seed phrases were extracted from the breached systems.

What Reports Say About How the Attack Happened

The technical account remains unsettled. The supplied alert attributes the breach to exploited vulnerabilities in Foundation’s self-hosted Cal.com booking system and Bank-Vaults, while several later media reports say the phishing-email capability was linked to compromised Cloudflare API keys and that the precise entry point remained under investigation.

These accounts may describe different stages of the same incident, but the relationship between them is not established by the supplied evidence. One follow-up media report also described a backend compromise through a self-hosted application and possible access to the customer-support inbox, pointing in the same broad direction without resolving the sequence of events.

Clearer than the exact entry point is the operational outcome: attackers reportedly gained sufficient access and customer information to send convincing scam messages from Foundation-linked infrastructure, then pivoted to recovery-phrase fraud. Foundation was also reported to be planning to reduce its use of self-hosted servers in favor of externally managed services, although the supplied material did not establish an implementation timeline.