---
title: Foundation, maker of the Passport Bitcoin hardware wallet, says fake "active incident" emails went out from its own domains after Cloudflare API keys were compromised | ctxsec
url: https://ctxsec.com/items/foundation-passport-spam-compromised-cloudflare-api-keys
description: ""
status: "confirmed by the vendor (Foundation statements Oct 25-26): spoofed emails via compromised Cloudflare API keys; customer support inbox compromised per CEO. Full scope of customer data accessed still under investigation, last updated Oct 26, 2026, 8:05 AM ET"
published: 2026-10-25
updated: 2026-10-26T08:05:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/foundation-passport-spam-compromised-cloudflare-api-keys.md)

confirmed by the vendor (Foundation statements Oct 25-26): spoofed emails via compromised Cloudflare API keys; customer support inbox compromised per CEO. Full scope of customer data accessed still under investigation

2026-10-25 · updated

Oct 26, 2026, 8:05 AM ET

### Foundation, maker of the Passport Bitcoin hardware wallet, says fake "active incident" emails went out from its own domains after Cloudflare API keys were compromised

**Update Oct 26:** Foundation CEO **Zach Herbert** says the company's **customer support inbox was compromised**. He believes the personal details in the phishing emails came from past support conversations about orders. He said the entry point is believed to be a self-hosted app (he named Cal.com, the scheduling tool) and that a detailed report will follow. He says Foundation is still working out whether the entire customer list or only support-inbox contacts were exposed, and that people on its mailing lists did not receive the emails. Foundation also acknowledged that some old order records may not have been purged as its earlier privacy policy promised, and says it will publish a formal report, including what it is changing. Foundation repeats that funds on Passport are safe and the hardware is not compromised.

Late on Oct 25 (ET), Passport owners began posting screenshots of an email styled as an "active incident" notice from Foundation, warning that their device was compromised and urging action. Foundation then confirmed that **spam emails were sent that appear to come from official Foundation domains**, that it traced this to **one or more compromised API keys on Cloudflare**, that it has **revoked all API keys**, and that the malicious domain linked in the email has been taken down.

Several recipients say the emails included their full name, home address and phone number from past Passport orders. Per the Oct 26 update above, Foundation links this to its compromised support inbox but hasn't yet confirmed the full scope.

If you own a Passport: don't act on device-security emails, even ones that pass sender checks for foundation.xyz. Never enter a seed phrase anywhere a message points you, and check Foundation's official channels directly. Because the mail came from real domains, SPF/DKIM "pass" results don't make it trustworthy.

Sources: [Foundation (@FoundationHQ) announcement on X (Oct 25, 11:47 PM ET)](https://x.com/FoundationHQ/status/2114564656199069844) · [Zach Herbert (Foundation CEO) on X: "Our customer support box was compromised" (Oct 26)](https://x.com/zherbert/status/2114606408427794640) · [Zach Herbert on X: entire customer list vs. support-inbox emails still being determined (Oct 26)](https://x.com/zherbert/status/2114612578269683976) · [Zach Herbert on X: app believed to be a self-hosted Cal.com instance; detailed report coming (Oct 26)](https://x.com/zherbert/status/2114619751528030681) · [Foundation on X: old records retention under investigation, formal report coming (Oct 26)](https://x.com/FoundationHQ/status/2114671514683387911)