Passport hardware wallet maker Foundation said it has identified more than 23,000 phishing email attempts, including 19,057 messages delivered through Mailgun and 1,503 sent via Google Workspace. The number of affected users remains unknown.

The investigation found that personal information from historical WooCommerce orders remained in legacy database tables despite appearing redacted in the admin dashboard. Customer data from orders placed through Shopify since May may also have been exposed. Foundation said it has revoked affected email credentials and taken compromised legacy services offline. There is no evidence that Passport devices or their private keys were compromised. The phishing emails attempted to trick users into revealing their wallet recovery phrases.