- Hardware wallet manufacturer Foundation is facing intense scrutiny from users after highly accurate personal information appeared in targeted phishing emails.
- Affected customers are challenging whether customer databases were compromised beyond the acknowledged issue of compromised Cloudflare API keys.
- Foundation has taken initial mitigation steps, including revoking the exposed Cloudflare credentials and taking down the malicious domain used in the spam campaign.
Hardware wallet maker Foundation is confronting mounting backlash from its user base after customers reported receiving sophisticated phishing emails containing accurate personal records. The security incident has sparked serious questions regarding the company’s internal data retention protocols and whether internal customer databases were accessed alongside previously confirmed infrastructure compromises.
Customer Backlash Mounts Over Phishing Details
Many users expressed disappointment and raised questions about how the incident unfolded, particularly regarding the depth of personal details circulating in fraudulent messages. Among those vocalizing concerns was Jerry Gensler, who expressed his displeasure after discovering that a phishing email still contained his personal information despite previously requesting its deletion.
“I’m a little disappointed here. I took the time to email you guys asking to have any and all of my personal data deleted from Foundation’s end. I was replied to on a burner email account that I’d provided for confirmation, and given assurances that all my personal data was deleted from Foundation’s end for good. I am confused how this phishing email still accurately has all of my personal info included?”
The specificity of the data utilized in the fraudulent emails suggests that the threat actors possessed comprehensive customer profiles. Joe Turner of Arise Bitcoin raised broader questions about the scope of the incident, specifically pressing the company on how attackers managed to gather sensitive shipping and contact data.
“How did the attackers obtain customers’ names, residential addresses, phone numbers and delivery details? Compromised Cloudflare API keys alone do not explain this. Has your customer database been breached, and what evidence do you have to rule that out?”
Scrutiny Surrounding Infrastructure and Data Retention
The collective reactions of the community highlight a critical technical distinction: while compromising infrastructure credentials such as Cloudflare API keys presents serious risks, it does not, by itself, account for the direct exfiltration of offline or isolated customer shipping records. Even so, the apparent accuracy of the personal information has intensified scrutiny of Foundation’s data protection practices, prompting urgent calls for transparency regarding back-end storage.
In response to the active campaign, Foundation revoked the compromised Cloudflare API keys and reported taking down the malicious domain linked to the spam emails. Nevertheless, customers continue to seek verification that unauthorized parties did not breach central database repositories.
Why This Matters
This incident highlights the fundamental difference between protecting Bitcoin funds and safeguarding customer data. While phishing emails do not automatically expose hardware wallet private keys or compromise on-chain assets, leaked personal information—such as physical home addresses and phone numbers—makes social engineering attacks far more convincing and introduces potential real-world security threats to Bitcoin holders.
To restore customer confidence, Foundation must thoroughly investigate how attackers obtained the sensitive data, definitively determine whether customer records were accessed during the intrusion, and directly address the privacy concerns raised by its community.
Frequently Asked Questions
Are users’ private keys or Bitcoin funds at risk from this incident?
No. Phishing emails and data exposures do not automatically expose private keys stored on hardware wallets. However, attackers can leverage exposed personal information to craft highly convincing social engineering scams designed to trick users into revealing their credentials.
What steps has Foundation taken so far?
Foundation revoked the compromised Cloudflare API keys and successfully coordinated the takedown of the malicious domain associated with the phishing campaign.
Why are customers questioning the Cloudflare API key explanation?
Users and security observers have pointed out that compromised Cloudflare API keys typically do not explain how attackers gained access to detailed customer records, including residential addresses, phone numbers, and delivery information, leading to questions over whether customer databases were separately breached.
