From CryptoPotato · By Wayne Jones
Foundation, which makes the Passport hardware wallet, has confirmed that phishing emails sent from its official domains were traced back to compromised Cloudflare API keys.
It also said that customer records were in systems that the attackers could reach, but it has so far found no evidence that Passport devices or their private keys had been affected.
What the Investigation Has Found So Far
The company first made the public aware of what was going on in an announcement on X yesterday, saying that spam emails had been sent to users and they appeared to have come from official Foundation domains.
It further pointed out that it had traced the issue to at least one compromised API key on Cloudflare. Following that discovery, it revoked all API keys and took down the malicious domain in the spam emails.
Interestingly, only days earlier, Foundation had cautioned followers on the social platform that their email accounts were likely to be their “single biggest point of failure” as far as their digital security was concerned. It advised users to secure their emails with strong and unique passwords, as well as to use different addresses for important accounts and have passkeys or authentication backed by hardware whenever available.
In a new update on the incident this morning, the firm shared that it had identified more than 23,000 phishing email attempts across its email systems, with about 19,000 messages sent through Mailgun and just over 1,500 via Google Workspace. According to them, some of the addresses got several messages, while other attempts failed or were stopped before they could be delivered.
Per Foundation’s initial investigation, order records from a service it had used in the past, WooCommerce, had survived database migration, even though customer records were supposed to be redacted 60 days after shipping. Apparently, the process updated newer tables shown in the store dashboard while copies stayed in older tables, while at the same time there were additional details that had persisted in refund records, abandoned carts, and contact forms.
However, 5,000 addresses that received phishing emails did not appear in Foundation’s WooCommerce records or those of the platform it moved to, Shopify. To be safe, the wallet maker said it is rotating keys across its system, even those it isn’t sure were accessed. It is also keeping offline a copy of the legacy WooCommerce data for investigators to use but will delete it permanently once investigations are completed.
“We have found no evidence that this incident compromised Passport devices or the private keys they hold,” the company wrote.
Other Wallet Makers Have Dealt With Similar Leaks
The last few months have seen several crypto wallet makers on the wrong end of data breaches, starting in August with ShipMonk, a Trezor provider that saw the information of more than 67,000 users of the wallet stolen, including their names, cities, and emails.