# Important security notice: emails that appeared to come from Foundation **URL:** \ **Category:** General\ **Created:** [October 26, 2026, 8:00am UTC](https://community.foundation.xyz/t/important-security-notice-emails-that-appeared-to-come-from-foundation/1296 "2026-10-26T08:00:47Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![qna](https://community.foundation.xyz/user_avatar/community.foundation.xyz/qna/32/284_2.png) [@qna](https://community.foundation.xyz/u/qna)\ **Post date:** [October 26, 2026, 8:00am UTC](https://community.foundation.xyz/t/important-security-notice-emails-that-appeared-to-come-from-foundation/1296/1 "2026-10-26T08:00:47Z")
Over the past few hours, some customers received emails that appeared to come from official Foundation domains. **These emails were not sent by Foundation.** Please do not click any links in them or reply to them. **Your Passport is safe.** **Funds stored on Passport are safe, and Passport devices are not compromised.** **What we know so far** - Attackers gained access to part of our backend infrastructure through a vulnerability in a self-hosted application. - They were likely able to access our customer support inbox, and they were able to send emails that appeared legitimate. - Within 10 minutes of the first reports, we shut down their ability to send emails and removed them from our systems. We have revoked all API keys, and the malicious domain used in the emails has been taken down. - Some of these emails included customers’ mailing addresses or phone numbers. We’re aware that people who have never ordered from us have also received them, so it’s likely the attacker is combining information from several recent data leaks before sending. We believe some details may also have come from access to our customer support inbox and possibly from recent orders on our new Shopify store. **Please stay vigilant** - Foundation will never ask for your seed words, recovery phrase, PIN or passphrase. - Never enter your seed words on any website, form or app. They belong only on your Passport and your own offline backups. - Ignore anyone who contacts you directly claiming to be Foundation, whether by email, phone, text or social media, especially if they ask you to move funds, verify your wallet or install software. We’re investigating exactly what happened and will share further updates as soon as we can. This topic will remain closed so that only staff members can post updates. We’re very sorry for the concern this has caused. ---
**Author:** ![qna](https://community.foundation.xyz/user_avatar/community.foundation.xyz/qna/32/284_2.png) [@qna](https://community.foundation.xyz/u/qna)\ **Post date:** [October 26, 2026, 8:02am UTC](https://community.foundation.xyz/t/important-security-notice-emails-that-appeared-to-come-from-foundation/1296/2 "2026-10-26T08:02:52Z")
---
**Author:** ![qna](https://community.foundation.xyz/user_avatar/community.foundation.xyz/qna/32/284_2.png) [@qna](https://community.foundation.xyz/u/qna)\ **Post date:** [October 26, 2026, 8:19am UTC](https://community.foundation.xyz/t/important-security-notice-emails-that-appeared-to-come-from-foundation/1296/3 "2026-10-26T08:19:01Z")
A post was merged into an existing topic: [Email scam?](https://community.foundation.xyz/t/email-scam/1292/18) ---
**Author:** ![qna](https://community.foundation.xyz/user_avatar/community.foundation.xyz/qna/32/284_2.png) [@qna](https://community.foundation.xyz/u/qna)\ **Post date:** [October 26, 2026, 8:17am UTC](https://community.foundation.xyz/t/important-security-notice-emails-that-appeared-to-come-from-foundation/1296/4 "2026-10-26T08:17:01Z")