Foundation, a hardware wallet maker, said attackers exploited a vulnerability in its self-hosted Cal.com scheduling software and another in Bank-Vaults to steal credentials and access customer records, email systems and domain settings. According to Odaily, the breach began on October 21, and on October 25 attackers attempted to send more than 23,000 phishing emails from a genuine Foundation email address to 21,463 email addresses.
The exposed information included names, home addresses, phone numbers, order records, customer-service communications and some payment card information. Scammers later used stolen purchase and payment details to call customers and try to obtain their Bitcoin wallet recovery phrases.
Foundation said employee accounts and devices were not affected and funds stored on Passport devices remain safe. The company said it would reduce its use of self-hosted infrastructure and shift to hosted services.