---
title: "Foundation Links Passport Phishing Campaign to Compromised Cloudflare API Keys"
description: "Hardware wallet maker Foundation confirmed phishing emails exposed customer purchase records, while device funds remain secure."
url: https://basisdesk.news/news/foundation-links-passport-phishing-to-cloudflare-api-keys
published: 2026-10-26T06:56:41.709Z
modified: 2026-10-26T06:56:41.709Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [BTC]
tags: [hardware-wallets, phishing, cloudflare, security, data-breach]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Foundation Links Passport Phishing Campaign to Compromised Cloudflare API Keys

Hardware wallet maker Foundation confirmed phishing emails exposed customer purchase records, while device funds remain secure.

## At a glance

- **What happened:** Foundation linked phishing emails targeting Passport users to compromised Cloudflare API keys.
- **Why it matters:** The breach exposed user contact and purchase records, though Foundation confirmed hardware security and funds are safe.
- **Who is affected:** Recipients of Foundation Passport phishing messages whose personal and purchase details were included in emails.
- **What's next:** No next step announced.
- **Primary source:** [Foundation Links Passport Phishing Emails to Compromised Cloudflare API Keys](https://thedefiant.io/news/security/foundation-links-passport-phishing-emails-to-compromised-cloudflare-api-keys) — thedefiant.io

## Key points

- Foundation linked Passport phishing emails to compromised Cloudflare API keys.
- Targeted messages contained personal information and order histories of customers.
- Foundation stated Passport hardware devices and user funds remain safe.

## Editorial remark

- **Context:** Hardware manufacturer Foundation detected a phishing campaign sent to customers of its Passport hardware wallet, tracing the origin to exposed Cloudflare API credentials.
- **Impact:** Customers who purchased Passport devices received deceptive communications featuring real personal and order data, though device security remained intact.
- **Watch:** Subsequent security notices or technical disclosures from Foundation regarding the rotation and auditing of its external infrastructure API keys.

Hardware wallet manufacturer Foundation has attributed a series of phishing emails directed at users of its Passport device to compromised Cloudflare API keys [1]. 

Recipients of the unauthorized communications reported that the messages included specific personal details and purchase records [1]. The inclusion of legitimate order histories suggests that external systems holding customer contact information were accessed via the compromised API credentials [1]. Foundation stated that Passport hardware devices and user funds were not impacted and remain safe [1].

## Compromise Limited to User Communications

The incident centers on communication systems rather than cryptographic hardware mechanisms, according to details disclosed by the company [1]. While recipients identified legitimate transactional details inside the fraudulent emails, Foundation maintained that core device security was not breached [1]. The compromise involved API keys associated with web infrastructure provider Cloudflare, leading directly to the delivery of the deceptive messages [1].

At the time of writing, Bitcoin ($BTC) traded around $79,747, while broader market sentiment sat neutral at 50 on the Fear & Greed Index. The incident marks another security event involving third-party infrastructure used by self-custody manufacturers [1]. Foundation indicated that while contact and purchase records were visible to message recipients, the operational integrity of the Passport hardware units and on-chain holdings remained secure throughout the event [1].

## Sources

1. [Foundation Links Passport Phishing Emails to Compromised Cloudflare API Keys](https://thedefiant.io/news/security/foundation-links-passport-phishing-emails-to-compromised-cloudflare-api-keys) — thedefiant.io, 2026-10-26

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai