Foundation, the maker of the Passport hardware wallet, reported an attack on November 26 in which more than 23,000 phishing emails were sent from spoofed official domains to steal users’ recovery phrases. The attackers may have accessed personal information held in the company’s former WooCommerce store and current Shopify store, including approximately 5,600 mailing addresses and 5,200 phone numbers alongside names and email addresses. Foundation cannot confirm whether every accessible record was viewed and is therefore treating the information as potentially exposed, while more than 5,000 recipients of the malicious emails were not listed in its customer databases. The company revoked compromised API keys, removed the malicious domain, took legacy services offline and rotated keys and secrets across its systems. However, the company has found no evidence that Passport hardware wallets or the private keys stored on them were compromised.
Source: Read the original article
