Hardware wallet Passport developer: Over 23,000 phishing email attempts detected, suspected customer data leak.

Hardware wallet Passport developer Foundation has issued an update on its security incident, disclosing that over 23,000 phishing email attempts have been identified. Of these, 19,057 were sent via Mailgun and 1,503 via Google Workspace, with some emails failing to be delivered. The actual number of affected users remains under investigation. The probe found that when Foundation previously used WooCommerce, historical orders were desensitized in the backend, but old data tables left after database migration still stored customer personal information. Similar issues were also detected in refund records and incomplete order carts. Additionally, customer information from new orders following the company’s migration to Shopify in May this year may have been leaked. Foundation stated that it has revoked affected email credentials and shut down related legacy services, noting there is currently no evidence indicating Passport devices or their private keys were compromised.