Foundation, the company behind the Passport Bitcoin hardware wallet, says attackers reached customer information that should have been removed from its online store. The records were still in legacy database tables even though the company’s WooCommerce dashboard displayed the orders as redacted. The disclosure, detailed in an October 26 investigation update, followed more than 23,000 phishing email attempts involving the company’s mail systems.
The incident raises an uncomfortable question for hardware-wallet buyers: what protection does a device’s offline private-key design provide when the seller still holds an accessible record of the customer’s identity, telephone number and home address?
BlockBriefing reviewed Foundation’s own October 26 investigation update, the company’s original security notice, and WooCommerce’s official technical documentation. The evidence points to a weakness in customer-data retention and verification of deletion, not a demonstrated break of the Passport device or its cryptography. The investigation remains open; the number of customers exposed has not been established.
Orders looked deleted. The old tables disagreed
Foundation says its previous WooCommerce-based store was configured to redact personal order information 60 days after a product shipped. Staff viewing older purchases in the store dashboard saw customer details removed and records marked as redacted.
But database migrations had copied orders into newer tables without removing the original rows, according to the company. The privacy process changed only the newer data—the version the administration screen displayed. Copies in older tables still contained personal information, and those systems were accessible to the attackers.
Foundation also discovered personal details in refund records and abandoned shopping carts. Some of that information had been entered by people who never finished buying a device. The company said it is still examining why those datasets escaped the intended removal process.
The distinction is crucial. A record disappearing from an application screen is not proof it has been deleted from every database table, archived copy or connected service. Foundation acknowledged that relying on the dashboard’s status was insufficient verification.
WooCommerce’s official documentation describes anonymization and retention controls for order information. It does not establish that WooCommerce itself caused Foundation’s legacy-table problem, nor does Foundation’s statement identify a confirmed general vulnerability affecting all WooCommerce installations. The failure described is specific to the company’s storage, migrations and deletion workflow.
More than 23,000 phishing attempts, not 23,000 victims
Foundation identified more than 23,000 phishing email attempts across its systems, including 19,057 messages it says were delivered through Mailgun and 1,503 sent through Google Workspace. Some intended recipients received multiple messages, while some attempts failed or were stopped before delivery.
Those delivery counts must not be treated as a count of customers who lost personal information, a count of unique people contacted or proof that any Bitcoin was stolen. Foundation has not established how many distinct individuals were affected.
The company initially said messages appearing to come from its official domains were linked to one or more compromised Cloudflare API keys. It revoked those keys and took down the malicious domain. In its subsequent update, Foundation said it had revoked affected email credentials, cleared queued phishing messages and taken compromised legacy services offline while preserving evidence.
The emails exploited more than a forged logo. They reportedly contained real personal or purchase details, making a fraudulent recovery-phrase request sound like an authentic customer-support interaction. Private keys did not have to be stolen from a hardware device for recipients to face a serious phishing risk.
Why the May store migration matters
Foundation moved from WooCommerce to Shopify in May 2026. The company disclosed that personal information from orders made on the newer store may also have been exposed. Those records had not been manually redacted, while a new automatic deletion tool was still being developed and had not begun running.
The disclosure therefore involves two separate data-governance questions: why old copies survived a supposedly completed redaction process, and how recent order data was protected while a replacement deletion process remained unfinished.
Foundation said it is also investigating whether information from its systems was combined with data from other sources. Some recipients reported details they believed they had never given to the company. This is not evidence of an identified second breach or a link to another wallet manufacturer; no such relationship has been established.
Why a redacted dashboard cannot prove deletion
According to WooCommerce’s own documentation, merchants can anonymize records through privacy settings and erasure requests. These actions can remove personal fields from an active order view, but the documentation does not establish that unrelated archived copies left by a merchant’s past database migrations will also be purged automatically.
Foundation’s investigation illustrates that distinction. The company says its dashboard marked historical orders as redacted while separate legacy tables still retained names and addresses. This is evidence about Foundation’s particular data-storage workflow, not proof of a general WooCommerce platform vulnerability.
The broader operational lesson is that deletion must be checked against all actual data stores, including historical tables, refunds and abandoned carts. For a company selling financial self-custody equipment, those retained customer details could enable targeted phishing even if the devices themselves continue to secure private keys.
The questions Foundation has not answered
The full scope remains unresolved. Foundation has not yet supplied a verified count of people whose personal records were exposed, a complete attacker-access timeline, or an independent forensic assessment of the records removed from every legacy system. It has also not established whether anyone surrendered a recovery phrase or lost funds after receiving the scam messages.
The company says it plans to share its findings with WooCommerce and relevant plugin developers. It has advised other store operators to inspect their databases beyond the administrative screen, including legacy tables, refunds and abandoned carts. That warning is a practical outcome of the incident, but not proof of a platform-wide flaw.
What Passport owners should do
Foundation says it has found no evidence that Passport devices or the private keys stored on them were compromised. Owners should not interpret the phishing campaign as confirmation that their device generated an unsafe recovery phrase or that every wallet balance is at risk.
The immediate defense is against social engineering. Verify security notices through a website address entered directly in the browser rather than a link in an unsolicited email. Never type a recovery phrase into a website or share it with purported support staff, even if the message contains accurate order information.
For merchants and wallet makers, the wider lesson is to verify deletion at the storage level. A clean-looking dashboard can coexist with sensitive copies in older tables. In a business that sells financial self-custody products, those copies may be as valuable to an attacker as the mailing system used to reach buyers.
Source note, October 27, 2026 (UTC): This report analyzes public company statements and technical documentation. BlockBriefing did not obtain Foundation’s databases, validate individual phishing emails, identify attackers or conduct a forensic audit of the devices. The findings are attributed to Foundation where appropriate. Primary references: Foundation investigation update; Foundation’s initial security disclosure; WooCommerce retention documentation.
