Hacking Attempt

[alpacastan22m]

Thank you

[DAG]

Where is @Ben @qna @zherbert when you need them? This is very disturbing. just rushed out of an event to get home. I could care less about anyone having my address as I am an expat. So good luck trying to find me

[Ckaribe]

The email was sent through mg.foundation.xyz, using IP address 159.112.252.180, which is associated with Mailgun’s email-delivery infrastructure. The DKIM signature was authenticated for foundation.xyz. it indicates the message traveled through email infrastructure authorized to send on behalf of Foundation’s domain. However, successful authentication does not establish that Foundation authorized the message. Someone could potentially have obtained unauthorized access to its mailing system or sending credentials.

[alpacastan22m]

They have our phone numbers…

[alpacastan22m]

They do.

[911f5a746cfe2836]

I don’t suppose it ever occurred to anyone that the data might first have been uploaded to third-party servers.

[alpacastan22m]

Wonder how they’re going to justify

[Socrates]

Doubt they will justify it. They will admit how and what happened and apologize for the breach of customer trust, just the same way the other HWW vendors did (Ledger, Trezor, Bitbox, Keystone…)

[SnarkyAlien]

Yes. Everything about you. Order, name, address, email, phone number, even the method of shipment.

[Whitedog]

Does anyone know how long Foundation keep your personal details, like delivery address for? in my email it didn’t show the delivery address. Wondering if that is only for recent purchases that have been breached?

[Galneryus]

To play the devil’s advocate, the breach might have been some time ago and the data kept for this moment.

[XQD2Iu]

I’m so disappointed in Zach and his team right now. My residential address, phone number, email address, everything is out there. My delivery was almost a year ago, and they kept all this data around, possibly even on MAILGUN, of all places. All the while lying about deleting the data out of “love” for their customers.

Luckily I’ve since moved houses, and used a disposable email address, but I guess I’ll have to live with scam phone calls now, and I may have to warn the new residents at my old address that they might get scary visitors.

[KonaGecko]

Not Good and Not Happy !

[qna]

Important security notice: emails that appeared to come from Foundation

Over the past few hours, some customers received emails that appeared to come from official Foundation domains. These emails were not sent by Foundation. Please do not click any links in them or reply to them. Your Passport is safe. Funds stored on Passport are safe, and Passport devices are not compromised. What we know so far Attackers gained access to part of our backend infrastructure through a vulnerability in a self-hosted application. They were likely able to access our customer s…

[911f5a746cfe2836]

[qna]

Just in case anyone misses the official incident updates, they are being posted in this thread.

Important security notice: emails that appeared to come from Foundation

Incident Update 2 In our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers. The numbers Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, s…

[911f5a746cfe2836]

Thank you for the update. The one on Reddit is helpful too. I appreciate your transparency. But I struggle to understand how a Cloudflare API key could somehow give an attacker this level of access. I almost wonder if it was an inside job.

[qna]

This was not an inside job. There will be a full report later this week.