Incidents
Foundation Passport phishing emails: what happened and what to verify
By Jolly Ledger editorial · Published · Reviewed · 4 min read
Event date: October 2026; 26 October 2026 update reviewed for this article
Dated incident snapshot. Editorial review: 27 October 2026. This explainer reflects sources reviewed on that date. Open the original notice for subsequent updates before acting.
Short answer
Foundation reported unauthorized backend access and phishing emails that appeared to come from its domains. Its 26 October update treats records with roughly 5,600 mailing addresses and 5,200 phone numbers as potentially exposed, and Foundation said it found no evidence that Passport devices or private keys were compromised.
An email can look familiar, mention a real order and still be an attack. Foundation’s October notice describes emails that appeared to come from official domains but were not sent by the company. The important questions are what the attacker could reach and what, if anything, the recipient did next.
What Foundation first reported
Foundation says attackers entered part of its backend infrastructure through a vulnerability in a self-hosted application, were likely able to access its customer support inbox, and could send apparently legitimate emails. Foundation reports removing their access and revoking API keys.
The 26 October update
In its 26 October 2026 update reviewed for this article (shown as 6:53pm, with no timezone given), Foundation said systems the attacker could reach held records with approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses. It said it cannot confirm that all of those records were accessed, and is treating all of them as potentially exposed.
Foundation explained why some data was still there: legacy database tables had retained information, its 60-day redaction process had missed some order types, and abandoned carts and contact forms had kept data too.
Foundation also said that more than 5,000 email addresses that received phishing emails did not appear in its shop customer records. Some matched addresses from its support or hiring inboxes; the origin of others was still being traced. In other words, the number of addresses that received phishing emails is not the number of people whose records were exposed (and the number of unique people behind those addresses is not established) — the two groups overlap only partly.
| What Foundation says | What it does not establish |
|---|---|
| ~5,600 addresses and ~5,200 phone numbers were in reachable systems | That every one of those records was accessed |
| Phishing reached people outside its customer records | That those people’s data came from Foundation |
| No evidence Passport devices or private keys were compromised | That a recipient who later shared recovery words is safe |
Personal details are not wallet credentials
Foundation said it found no evidence that Passport devices or private keys were compromised. Knowing your address does not let someone authorize transactions. It can, however, make a request to install software or reveal recovery words feel more credible. Read why an official-looking sender is not enough.
Free steps to take now
- Do not reply, follow message links or install the proposed software.
- Open Foundation’s official site yourself and find its current notice and support route.
- Keep the message and note whether you clicked, downloaded, entered information or approved anything.
- Never provide recovery words, a PIN or a passphrase to anyone who contacts you.
- If you revealed a wallet secret, seek urgent, device-specific instructions through verified official support.
- Because postal addresses and phone numbers may be exposed, be wary of letters, calls and texts as well as email.
Match the response to what happened
Receiving a message does not establish wallet compromise. Downloading software, approving an action and revealing recovery words require different responses. Use the interaction guide to describe your actions accurately, and verify any support message through a channel you found yourself. Do not reset a working device or improvise a transfer because a phishing email demands it.
Sources
- Important security notice: emails that appeared to come from Foundation — FoundationOfficial community thread including the update dated 26 October 2026, displayed as 6:53pm (timezone not stated). Figures are Foundation’s own estimates.
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Prepare for the next disruption
This checkup cannot diagnose a current compromise or tell you whether funds are at risk. It helps you prepare: backups, official instructions and a family briefing.
Start the free preparation checkup