Today’s update on Foundation’s customer data leak scandal (which they call “Phishing Incident”) was shared only by email, so I’ll paste it here:
Hi,
On 26 October, attackers sent phishing emails that appeared to come from Foundation, claiming a Passport recall and asking recipients to move their funds. Here is what we have confirmed since then.
What happened
Attackers gained access to part of our backend infrastructure through a vulnerability in a self-hosted application. From there, they were able to send emails through our own email systems. We identified more than 23,000 phishing email attempts, including 19,057 messages delivered through Mailgun and 1,503 sent through Google Workspace.
We have found no evidence that this incident compromised Passport devices or the private keys they hold.
What personal information was exposed
Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We can’t say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed.
These records are a subset of our total customers.
Why older data was still there
Before moving to Shopify in May, our store ran on WooCommerce. We had configured automatic redaction of customer details 60 days after shipping, and when we viewed those orders in our store admin, the customer details were no longer visible.
During past database migrations, orders were copied into a new set of tables, but copies remained in the old tables. The redaction process updated the newer tables, which were also what our store admin displayed. Orders therefore appeared redacted even though older copies still contained personal information. The 60-day redaction also did not cover every type of order, and some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached.
We relied on the redaction shown in our admin dashboard, and we now know that was insufficient to verify that the underlying data had been removed. Protecting your information was still our full responsibility, and we’re sorry.
When we moved to Shopify in May, we updated our privacy policy to reflect how order data is handled there. Shopify does not offer automatic redaction, so orders placed on our Shopify store since then had not yet been redacted while we built a tool to automate it.
Data from outside Foundation
More than 5,000 of the addresses that received phishing emails do not appear in our customer records. Some match our support and hiring inboxes, and some people received details they never shared with us. This makes us confident the attackers also used data from outside Foundation. We are still attempting to trace where these addresses came from.
What we’ve done
- Revoked the affected email credentials and cleared the queued phishing messages.
- Taken the affected legacy services offline.
- Begun rotating every key and secret across our systems, including those we have no evidence were accessed.
- Reported the phishing websites for takedown.
We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted.
What to watch out for
- Some of the phishing websites are still active. Don’t click links in unexpected emails, and type foundation[.]xyz yourself.
- Be on guard for follow-up attempts by phone, text or post as well as email, including offers of replacement devices or refunds.
- Foundation will never ask for your recovery phrase, PIN or passphrase, or ask you to move funds.
Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation.
We’ll publish our full report when the investigation is complete. Until then, all updates will be posted here:
We’re very sorry for the concern and disruption this has caused. If you have any questions, feel free to reach out to us at hello@foundation.xyz.
The Foundation team